kernel: bump 6.6 to 6.6.144

Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.144

Manual rebased patch:
bcm27xx/patches-6.6/950-0464-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch [1]

Removes upstreamed patch:
bcm27xx/patches-6.6/950-1552-drm-v3d-Set-job-pointer-to-NULL-when-the-job-s-fence.patch [2]

All other patches autorefreshed.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit?h=v6.6.144&id=756724002c5a65b07af067849ba365a51fc6f207
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit?h=v6.6.144&id=756724002c5a65b07af067849ba365a51fc6f207

Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24082
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

15 files changed, 61 insertions, 145 deletions

diff --git a/include/kernel-6.6 b/include/kernel-6.6
index 5c1963a8dc..12de780cf1 100644
--- a/include/kernel-6.6
+++ b/include/kernel-6.6
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .143
-LINUX_KERNEL_HASH-6.6.143 = dace1f8dc9c0dbf5df14f47e3229cd62c298e83049681731ef229f2ba7592932
+LINUX_VERSION-6.6 = .144
+LINUX_KERNEL_HASH-6.6.144 = ec19b8307b495078cdc03749e63cb3802ac23cf6122c82eb9719feeb4557ecc3
diff --git a/target/linux/bcm27xx/patches-6.6/950-0167-drm-v3d-Clock-V3D-down-when-not-in-use.patch b/target/linux/bcm27xx/patches-6.6/950-0167-drm-v3d-Clock-V3D-down-when-not-in-use.patch
index fab52c63d0..da4eb8f561 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0167-drm-v3d-Clock-V3D-down-when-not-in-use.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0167-drm-v3d-Clock-V3D-down-when-not-in-use.patch
@@ -59,7 +59,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  irq_disable:
 --- a/drivers/gpu/drm/v3d/v3d_drv.h
 +++ b/drivers/gpu/drm/v3d/v3d_drv.h
-@@ -84,6 +84,12 @@ struct v3d_dev {
+@@ -87,6 +87,12 @@ struct v3d_dev {
  	void __iomem *bridge_regs;
  	void __iomem *gca_regs;
  	struct clk *clk;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0183-drm-v3d-Suppress-all-but-the-first-MMU-error.patch b/target/linux/bcm27xx/patches-6.6/950-0183-drm-v3d-Suppress-all-but-the-first-MMU-error.patch
index d41fab9d94..1138d54995 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0183-drm-v3d-Suppress-all-but-the-first-MMU-error.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0183-drm-v3d-Suppress-all-but-the-first-MMU-error.patch
@@ -13,7 +13,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/gpu/drm/v3d/v3d_irq.c
 +++ b/drivers/gpu/drm/v3d/v3d_irq.c
-@@ -189,6 +189,7 @@ v3d_hub_irq(int irq, void *arg)
+@@ -193,6 +193,7 @@ v3d_hub_irq(int irq, void *arg)
  			"GMP",
  		};
  		const char *client = "?";
@@ -21,7 +21,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  		V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL));
  
-@@ -198,6 +199,7 @@ v3d_hub_irq(int irq, void *arg)
+@@ -202,6 +203,7 @@ v3d_hub_irq(int irq, void *arg)
  				client = v3d41_axi_ids[axi_id];
  		}
  
@@ -29,7 +29,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  		dev_err(v3d->drm.dev, "MMU error from client %s (%d) at 0x%llx%s%s%s\n",
  			client, axi_id, (long long)vio_addr,
  			((intsts & V3D_HUB_INT_MMU_WRV) ?
-@@ -206,6 +208,7 @@ v3d_hub_irq(int irq, void *arg)
+@@ -210,6 +212,7 @@ v3d_hub_irq(int irq, void *arg)
  			 ", pte invalid" : ""),
  			((intsts & V3D_HUB_INT_MMU_CAP) ?
  			 ", cap exceeded" : ""));
diff --git a/target/linux/bcm27xx/patches-6.6/950-0464-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch b/target/linux/bcm27xx/patches-6.6/950-0464-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch
index edf49764b7..c79666ddbb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0464-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0464-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch
@@ -156,8 +156,8 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  struct v3d_queue_state {
  	struct drm_gpu_scheduler sched;
  
-@@ -28,6 +41,44 @@ struct v3d_queue_state {
- 	u64 emit_seqno;
+@@ -31,6 +44,44 @@ struct v3d_queue_state {
+ 	struct v3d_job *active_job;
  };
  
 +struct v3d_queue_pid_stats {
@@ -201,7 +201,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  /* Performance monitor object. The perform lifetime is controlled by userspace
   * using perfmon related ioctls. A perfmon can be attached to a submit_cl
   * request, and when this is the case, HW perf counters will be activated just
-@@ -155,6 +206,8 @@ struct v3d_dev {
+@@ -153,6 +204,8 @@ struct v3d_dev {
  		u32 num_allocated;
  		u32 pages_allocated;
  	} bo_stats;
@@ -210,7 +210,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  };
  
  static inline struct v3d_dev *
-@@ -252,6 +305,11 @@ struct v3d_job {
+@@ -250,6 +303,11 @@ struct v3d_job {
  	 */
  	struct v3d_perfmon *perfmon;
  
@@ -222,7 +222,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	/* Callback for the freeing of the job on refcount going to 0. */
  	void (*free)(struct kref *ref);
  };
-@@ -416,6 +474,7 @@ void v3d_mmu_remove_ptes(struct v3d_bo *
+@@ -414,6 +472,7 @@ void v3d_mmu_remove_ptes(struct v3d_bo *
  /* v3d_sched.c */
  int v3d_sched_init(struct v3d_dev *v3d);
  void v3d_sched_fini(struct v3d_dev *v3d);
@@ -250,34 +250,34 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  
  #include "v3d_drv.h"
  #include "v3d_regs.h"
-@@ -100,6 +101,7 @@ v3d_irq(int irq, void *arg)
+@@ -104,6 +105,7 @@ v3d_irq(int irq, void *arg)
  	if (intsts & V3D_INT_FLDONE) {
  		struct v3d_fence *fence =
- 			to_v3d_fence(v3d->bin_job->base.irq_fence);
+ 			to_v3d_fence(v3d->queue[V3D_BIN].active_job->irq_fence);
 +		v3d->gpu_queue_stats[V3D_BIN].last_exec_end = local_clock();
  
  		trace_v3d_bcl_irq(&v3d->drm, fence->seqno);
  
-@@ -112,6 +114,7 @@ v3d_irq(int irq, void *arg)
+@@ -116,6 +118,7 @@ v3d_irq(int irq, void *arg)
  	if (intsts & V3D_INT_FRDONE) {
  		struct v3d_fence *fence =
- 			to_v3d_fence(v3d->render_job->base.irq_fence);
+ 			to_v3d_fence(v3d->queue[V3D_RENDER].active_job->irq_fence);
 +		v3d->gpu_queue_stats[V3D_RENDER].last_exec_end = local_clock();
  
  		trace_v3d_rcl_irq(&v3d->drm, fence->seqno);
  
-@@ -124,6 +127,7 @@ v3d_irq(int irq, void *arg)
+@@ -128,6 +131,7 @@ v3d_irq(int irq, void *arg)
  	if (intsts & V3D_INT_CSDDONE) {
  		struct v3d_fence *fence =
- 			to_v3d_fence(v3d->csd_job->base.irq_fence);
+ 			to_v3d_fence(v3d->queue[V3D_CSD].active_job->irq_fence);
 +		v3d->gpu_queue_stats[V3D_CSD].last_exec_end = local_clock();
  
  		trace_v3d_csd_irq(&v3d->drm, fence->seqno);
  
-@@ -163,6 +167,7 @@ v3d_hub_irq(int irq, void *arg)
+@@ -167,6 +171,7 @@ v3d_hub_irq(int irq, void *arg)
  	if (intsts & V3D_HUB_INT_TFUC) {
  		struct v3d_fence *fence =
- 			to_v3d_fence(v3d->tfu_job->base.irq_fence);
+ 			to_v3d_fence(v3d->queue[V3D_TFU].active_job->irq_fence);
 +		v3d->gpu_queue_stats[V3D_TFU].last_exec_end = local_clock();
  
  		trace_v3d_tfu_irq(&v3d->drm, fence->seqno);
@@ -407,7 +407,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  static struct dma_fence *v3d_bin_job_run(struct drm_sched_job *sched_job)
  {
  	struct v3d_bin_job *job = to_bin_job(sched_job);
-@@ -107,6 +216,7 @@ static struct dma_fence *v3d_bin_job_run
+@@ -111,6 +220,7 @@ static struct dma_fence *v3d_bin_job_run
  	trace_v3d_submit_cl(dev, false, to_v3d_fence(fence)->seqno,
  			    job->start, job->end);
  
@@ -415,7 +415,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	v3d_switch_perfmon(v3d, &job->base);
  
  	/* Set the current and end address of the control list.
-@@ -158,6 +268,7 @@ static struct dma_fence *v3d_render_job_
+@@ -164,6 +274,7 @@ static struct dma_fence *v3d_render_job_
  	trace_v3d_submit_cl(dev, true, to_v3d_fence(fence)->seqno,
  			    job->start, job->end);
  
@@ -423,7 +423,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	v3d_switch_perfmon(v3d, &job->base);
  
  	/* XXX: Set the QCFG */
-@@ -194,6 +305,7 @@ v3d_tfu_job_run(struct drm_sched_job *sc
+@@ -202,6 +313,7 @@ v3d_tfu_job_run(struct drm_sched_job *sc
  
  	trace_v3d_submit_tfu(dev, to_v3d_fence(fence)->seqno);
  
@@ -431,7 +431,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	V3D_WRITE(V3D_TFU_IIA, job->args.iia);
  	V3D_WRITE(V3D_TFU_IIS, job->args.iis);
  	V3D_WRITE(V3D_TFU_ICA, job->args.ica);
-@@ -238,6 +350,7 @@ v3d_csd_job_run(struct drm_sched_job *sc
+@@ -258,6 +370,7 @@ v3d_csd_job_run(struct drm_sched_job *sc
  
  	trace_v3d_submit_csd(dev, to_v3d_fence(fence)->seqno);
  
@@ -439,7 +439,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	v3d_switch_perfmon(v3d, &job->base);
  
  	for (i = 1; i <= 6; i++)
-@@ -254,7 +367,10 @@ v3d_cache_clean_job_run(struct drm_sched
+@@ -274,7 +387,10 @@ v3d_cache_clean_job_run(struct drm_sched
  	struct v3d_job *job = to_v3d_job(sched_job);
  	struct v3d_dev *v3d = job->v3d;
  
@@ -450,7 +450,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  
  	return NULL;
  }
-@@ -406,8 +522,18 @@ v3d_sched_init(struct v3d_dev *v3d)
+@@ -426,8 +542,18 @@ v3d_sched_init(struct v3d_dev *v3d)
  	int hw_jobs_limit = 1;
  	int job_hang_limit = 0;
  	int hang_limit_ms = 500;
@@ -469,7 +469,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	ret = drm_sched_init(&v3d->queue[V3D_BIN].sched,
  			     &v3d_bin_sched_ops,
  			     hw_jobs_limit, job_hang_limit,
-@@ -461,9 +587,20 @@ void
+@@ -481,9 +607,20 @@ void
  v3d_sched_fini(struct v3d_dev *v3d)
  {
  	enum v3d_queue q;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0555-drm-v3d-fix-up-register-addresses-for-V3D-7.x.patch b/target/linux/bcm27xx/patches-6.6/950-0555-drm-v3d-fix-up-register-addresses-for-V3D-7.x.patch
index b755c393b5..4e95b1754c 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0555-drm-v3d-fix-up-register-addresses-for-V3D-7.x.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0555-drm-v3d-fix-up-register-addresses-for-V3D-7.x.patch
@@ -295,7 +295,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  
  static irqreturn_t
  v3d_hub_irq(int irq, void *arg);
-@@ -124,7 +125,8 @@ v3d_irq(int irq, void *arg)
+@@ -128,7 +129,8 @@ v3d_irq(int irq, void *arg)
  		status = IRQ_HANDLED;
  	}
  
@@ -303,9 +303,9 @@ v2: fix kernel panic with debug-fs interface to list registers
 +	if ((v3d->ver < 71 && (intsts & V3D_INT_CSDDONE)) ||
 +	    (v3d->ver >= 71 && (intsts & V3D_V7_INT_CSDDONE))) {
  		struct v3d_fence *fence =
- 			to_v3d_fence(v3d->csd_job->base.irq_fence);
+ 			to_v3d_fence(v3d->queue[V3D_CSD].active_job->irq_fence);
  		v3d->gpu_queue_stats[V3D_CSD].last_exec_end = local_clock();
-@@ -140,7 +142,7 @@ v3d_irq(int irq, void *arg)
+@@ -144,7 +146,7 @@ v3d_irq(int irq, void *arg)
  	/* We shouldn't be triggering these if we have GMP in
  	 * always-allowed mode.
  	 */
@@ -314,7 +314,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  		dev_err(v3d->drm.dev, "GMP violation\n");
  
  	/* V3D 4.2 wires the hub and core IRQs together, so if we &
-@@ -217,6 +219,11 @@ v3d_hub_irq(int irq, void *arg)
+@@ -221,6 +223,11 @@ v3d_hub_irq(int irq, void *arg)
  		status = IRQ_HANDLED;
  	}
  
@@ -326,7 +326,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  	return status;
  }
  
-@@ -231,8 +238,8 @@ v3d_irq_init(struct v3d_dev *v3d)
+@@ -235,8 +242,8 @@ v3d_irq_init(struct v3d_dev *v3d)
  	 * for us.
  	 */
  	for (core = 0; core < v3d->cores; core++)
@@ -337,7 +337,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  
  	irq = platform_get_irq_optional(v3d_to_pdev(v3d), 1);
  	if (irq == -EPROBE_DEFER)
-@@ -287,12 +294,12 @@ v3d_irq_enable(struct v3d_dev *v3d)
+@@ -291,12 +298,12 @@ v3d_irq_enable(struct v3d_dev *v3d)
  
  	/* Enable our set of interrupts, masking out any others. */
  	for (core = 0; core < v3d->cores; core++) {
@@ -354,7 +354,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  }
  
  void
-@@ -313,8 +320,8 @@ v3d_irq_disable(struct v3d_dev *v3d)
+@@ -317,8 +324,8 @@ v3d_irq_disable(struct v3d_dev *v3d)
  
  	/* Clear any pending interrupts we might have left. */
  	for (core = 0; core < v3d->cores; core++)
@@ -591,7 +591,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  # define V3D_CSD_CURRENT_ID0_WG_Y_MASK                 V3D_MASK(15, 0)
 --- a/drivers/gpu/drm/v3d/v3d_sched.c
 +++ b/drivers/gpu/drm/v3d/v3d_sched.c
-@@ -282,6 +282,8 @@ static struct dma_fence *v3d_render_job_
+@@ -288,6 +288,8 @@ static struct dma_fence *v3d_render_job_
  	return fence;
  }
  
@@ -600,7 +600,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  static struct dma_fence *
  v3d_tfu_job_run(struct drm_sched_job *sched_job)
  {
-@@ -306,20 +308,22 @@ v3d_tfu_job_run(struct drm_sched_job *sc
+@@ -314,20 +316,22 @@ v3d_tfu_job_run(struct drm_sched_job *sc
  	trace_v3d_submit_tfu(dev, to_v3d_fence(fence)->seqno);
  
  	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_TFU], sched_job);
@@ -635,16 +635,16 @@ v2: fix kernel panic with debug-fs interface to list registers
  
  	return fence;
  }
-@@ -331,7 +335,7 @@ v3d_csd_job_run(struct drm_sched_job *sc
+@@ -339,7 +343,7 @@ v3d_csd_job_run(struct drm_sched_job *sc
  	struct v3d_dev *v3d = job->base.v3d;
  	struct drm_device *dev = &v3d->drm;
  	struct dma_fence *fence;
 -	int i;
 +	int i, csd_cfg0_reg, csd_cfg_reg_count;
  
- 	if (unlikely(job->base.base.s_fence->finished.error))
- 		return NULL;
-@@ -353,10 +357,12 @@ v3d_csd_job_run(struct drm_sched_job *sc
+ 	if (unlikely(job->base.base.s_fence->finished.error)) {
+ 		v3d->queue[V3D_CSD].active_job = NULL;
+@@ -373,10 +377,12 @@ v3d_csd_job_run(struct drm_sched_job *sc
  	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_CSD], sched_job);
  	v3d_switch_perfmon(v3d, &job->base);
  
@@ -660,7 +660,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  
  	return fence;
  }
-@@ -471,7 +477,8 @@ v3d_csd_job_timedout(struct drm_sched_jo
+@@ -491,7 +497,8 @@ v3d_csd_job_timedout(struct drm_sched_jo
  {
  	struct v3d_csd_job *job = to_csd_job(sched_job);
  	struct v3d_dev *v3d = job->base.v3d;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0905-drm-v3d-Enable-V3D-to-use-different-PAGE_SIZE.patch b/target/linux/bcm27xx/patches-6.6/950-0905-drm-v3d-Enable-V3D-to-use-different-PAGE_SIZE.patch
index 429df82ee7..3ac8826844 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0905-drm-v3d-Enable-V3D-to-use-different-PAGE_SIZE.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0905-drm-v3d-Enable-V3D-to-use-different-PAGE_SIZE.patch
@@ -96,8 +96,8 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  static inline char *
 --- a/drivers/gpu/drm/v3d/v3d_irq.c
 +++ b/drivers/gpu/drm/v3d/v3d_irq.c
-@@ -70,7 +70,7 @@ v3d_overflow_mem_work(struct work_struct
- 	list_add_tail(&bo->unref_head, &v3d->bin_job->render->unref_list);
+@@ -74,7 +74,7 @@ v3d_overflow_mem_work(struct work_struct
+ 	list_add_tail(&bo->unref_head, &bin_job->render->unref_list);
  	spin_unlock_irqrestore(&v3d->job_lock, irqflags);
  
 -	V3D_CORE_WRITE(0, V3D_PTB_BPOA, bo->node.start << PAGE_SHIFT);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1339-arm64-numa-Add-NUMA-emulation-for-ARM64.patch b/target/linux/bcm27xx/patches-6.6/950-1339-arm64-numa-Add-NUMA-emulation-for-ARM64.patch
index 1f17fa4d40..6bf268d4b4 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1339-arm64-numa-Add-NUMA-emulation-for-ARM64.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1339-arm64-numa-Add-NUMA-emulation-for-ARM64.patch
@@ -20,7 +20,7 @@ Cc: “Rafael J. Wysocki" <rafael@kernel.org>
 
 --- a/arch/arm64/Kconfig
 +++ b/arch/arm64/Kconfig
-@@ -1551,6 +1551,16 @@ config NODES_SHIFT
+@@ -1552,6 +1552,16 @@ config NODES_SHIFT
  	  Specify the maximum number of NUMA Nodes available on the target
  	  system.  Increases memory reserved to accommodate various tables.
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1552-drm-v3d-Set-job-pointer-to-NULL-when-the-job-s-fence.patch b/target/linux/bcm27xx/patches-6.6/950-1552-drm-v3d-Set-job-pointer-to-NULL-when-the-job-s-fence.patch
deleted file mode 100644
index 3bf33ffc75..0000000000
--- a/target/linux/bcm27xx/patches-6.6/950-1552-drm-v3d-Set-job-pointer-to-NULL-when-the-job-s-fence.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From 131564261399a36a5cf2ac2731ed1ceffba93d10 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Ma=C3=ADra=20Canal?= <mcanal@igalia.com>
-Date: Sat, 22 Feb 2025 14:56:46 -0300
-Subject: [PATCH] drm/v3d: Set job pointer to NULL when the job's fence has an
- error
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Similar to commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to
-NULL after job completion"), ensure the job pointer is set to `NULL` when
-a job's fence has an error. Failing to do so can trigger kernel warnings
-in specific scenarios, such as:
-
-1. v3d_csd_job_run() assigns `v3d->csd_job = job`
-2. CSD job exceeds hang limit, causing a timeout → v3d_gpu_reset_for_timeout()
-3. GPU reset
-4. drm_sched_resubmit_jobs() sets the job's fence to `-ECANCELED`.
-5. v3d_csd_job_run() detects the fence error and returns NULL, not
-   submitting the job to the GPU
-6. User-space runs `modprobe -r v3d`
-7. v3d_gem_destroy()
-
-v3d_gem_destroy() triggers a warning indicating that the CSD job never
-ended, as we didn't set `v3d->csd_job` to NULL after the timeout. The same
-can also happen to BIN, RENDER, and TFU jobs.
-
-Signed-off-by: Maíra Canal <mcanal@igalia.com>
----
- drivers/gpu/drm/v3d/v3d_sched.c | 18 ++++++++++++++----
- 1 file changed, 14 insertions(+), 4 deletions(-)
-
---- a/drivers/gpu/drm/v3d/v3d_sched.c
-+++ b/drivers/gpu/drm/v3d/v3d_sched.c
-@@ -189,8 +189,12 @@ static struct dma_fence *v3d_bin_job_run
- 	struct dma_fence *fence;
- 	unsigned long irqflags;
- 
--	if (unlikely(job->base.base.s_fence->finished.error))
-+	if (unlikely(job->base.base.s_fence->finished.error)) {
-+		spin_lock_irqsave(&v3d->job_lock, irqflags);
-+		v3d->bin_job = NULL;
-+		spin_unlock_irqrestore(&v3d->job_lock, irqflags);
- 		return NULL;
-+	}
- 
- 	/* Lock required around bin_job update vs
- 	 * v3d_overflow_mem_work().
-@@ -244,8 +248,10 @@ static struct dma_fence *v3d_render_job_
- 	struct drm_device *dev = &v3d->drm;
- 	struct dma_fence *fence;
- 
--	if (unlikely(job->base.base.s_fence->finished.error))
-+	if (unlikely(job->base.base.s_fence->finished.error)) {
-+		v3d->render_job = NULL;
- 		return NULL;
-+	}
- 
- 	v3d->render_job = job;
- 
-@@ -292,8 +298,10 @@ v3d_tfu_job_run(struct drm_sched_job *sc
- 	struct drm_device *dev = &v3d->drm;
- 	struct dma_fence *fence;
- 
--	if (unlikely(job->base.base.s_fence->finished.error))
-+	if (unlikely(job->base.base.s_fence->finished.error)) {
-+		v3d->tfu_job = NULL;
- 		return NULL;
-+	}
- 
- 	v3d->tfu_job = job;
- 
-@@ -337,8 +345,10 @@ v3d_csd_job_run(struct drm_sched_job *sc
- 	struct dma_fence *fence;
- 	int i, csd_cfg0_reg, csd_cfg_reg_count;
- 
--	if (unlikely(job->base.base.s_fence->finished.error))
-+	if (unlikely(job->base.base.s_fence->finished.error)) {
-+		v3d->csd_job = NULL;
- 		return NULL;
-+	}
- 
- 	v3d->csd_job = job;
- 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1553-drm-v3d-Associate-a-V3D-tech-revision-to-all-support.patch b/target/linux/bcm27xx/patches-6.6/950-1553-drm-v3d-Associate-a-V3D-tech-revision-to-all-support.patch
index bef7ceb96a..70c4de8c22 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1553-drm-v3d-Associate-a-V3D-tech-revision-to-all-support.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1553-drm-v3d-Associate-a-V3D-tech-revision-to-all-support.patch
@@ -275,7 +275,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  			goto clk_disable;
 --- a/drivers/gpu/drm/v3d/v3d_drv.h
 +++ b/drivers/gpu/drm/v3d/v3d_drv.h
-@@ -121,13 +121,20 @@ enum v3d_irq {
+@@ -124,13 +124,20 @@ enum v3d_irq {
  	V3D_MAX_IRQS,
  };
  
@@ -297,7 +297,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  	bool single_irq_line;
  
  	int irq[V3D_MAX_IRQS];
-@@ -221,7 +228,7 @@ to_v3d_dev(struct drm_device *dev)
+@@ -219,7 +226,7 @@ to_v3d_dev(struct drm_device *dev)
  static inline bool
  v3d_has_csd(struct v3d_dev *v3d)
  {
@@ -362,7 +362,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  	V3D_CORE_WRITE(core, V3D_CTL_L2CACTL,
 --- a/drivers/gpu/drm/v3d/v3d_irq.c
 +++ b/drivers/gpu/drm/v3d/v3d_irq.c
-@@ -125,8 +125,8 @@ v3d_irq(int irq, void *arg)
+@@ -129,8 +129,8 @@ v3d_irq(int irq, void *arg)
  		status = IRQ_HANDLED;
  	}
  
@@ -371,9 +371,9 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
 +	if ((v3d->ver < V3D_GEN_71 && (intsts & V3D_INT_CSDDONE)) ||
 +	    (v3d->ver >= V3D_GEN_71 && (intsts & V3D_V7_INT_CSDDONE))) {
  		struct v3d_fence *fence =
- 			to_v3d_fence(v3d->csd_job->base.irq_fence);
+ 			to_v3d_fence(v3d->queue[V3D_CSD].active_job->irq_fence);
  		v3d->gpu_queue_stats[V3D_CSD].last_exec_end = local_clock();
-@@ -142,7 +142,7 @@ v3d_irq(int irq, void *arg)
+@@ -146,7 +146,7 @@ v3d_irq(int irq, void *arg)
  	/* We shouldn't be triggering these if we have GMP in
  	 * always-allowed mode.
  	 */
@@ -382,7 +382,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  		dev_err(v3d->drm.dev, "GMP violation\n");
  
  	/* V3D 4.2 wires the hub and core IRQs together, so if we &
-@@ -200,7 +200,7 @@ v3d_hub_irq(int irq, void *arg)
+@@ -204,7 +204,7 @@ v3d_hub_irq(int irq, void *arg)
  
  		V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL));
  
@@ -391,7 +391,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  			axi_id = axi_id >> 5;
  			if (axi_id < ARRAY_SIZE(v3d41_axi_ids))
  				client = v3d41_axi_ids[axi_id];
-@@ -219,7 +219,7 @@ v3d_hub_irq(int irq, void *arg)
+@@ -223,7 +223,7 @@ v3d_hub_irq(int irq, void *arg)
  		status = IRQ_HANDLED;
  	}
  
@@ -425,7 +425,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  		V3D_WRITE(V3D_TFU_REG(COEF1), job->args.coef[1]);
  		V3D_WRITE(V3D_TFU_REG(COEF2), job->args.coef[2]);
  		V3D_WRITE(V3D_TFU_REG(COEF3), job->args.coef[3]);
-@@ -367,8 +367,8 @@ v3d_csd_job_run(struct drm_sched_job *sc
+@@ -377,8 +377,8 @@ v3d_csd_job_run(struct drm_sched_job *sc
  	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_CSD], sched_job);
  	v3d_switch_perfmon(v3d, &job->base);
  
@@ -436,7 +436,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  	for (i = 1; i <= csd_cfg_reg_count; i++)
  		V3D_CORE_WRITE(0, csd_cfg0_reg + 4 * i, job->args.cfg[i]);
  	/* CFG0 write kicks off the job. */
-@@ -487,7 +487,7 @@ v3d_csd_job_timedout(struct drm_sched_jo
+@@ -497,7 +497,7 @@ v3d_csd_job_timedout(struct drm_sched_jo
  {
  	struct v3d_csd_job *job = to_csd_job(sched_job);
  	struct v3d_dev *v3d = job->base.v3d;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1555-drm-v3d-Use-V3D_SMS-registers-for-power-on-off-and-r.patch b/target/linux/bcm27xx/patches-6.6/950-1555-drm-v3d-Use-V3D_SMS-registers-for-power-on-off-and-r.patch
index a8e4ea681f..490be78929 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1555-drm-v3d-Use-V3D_SMS-registers-for-power-on-off-and-r.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1555-drm-v3d-Use-V3D_SMS-registers-for-power-on-off-and-r.patch
@@ -98,7 +98,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  
 --- a/drivers/gpu/drm/v3d/v3d_drv.h
 +++ b/drivers/gpu/drm/v3d/v3d_drv.h
-@@ -143,6 +143,7 @@ struct v3d_dev {
+@@ -146,6 +146,7 @@ struct v3d_dev {
  	void __iomem *core_regs[3];
  	void __iomem *bridge_regs;
  	void __iomem *gca_regs;
@@ -106,7 +106,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  	struct clk *clk;
  	struct delayed_work clk_down_work;
  	unsigned long clk_up_rate, clk_down_rate;
-@@ -285,6 +286,15 @@ to_v3d_fence(struct dma_fence *fence)
+@@ -283,6 +284,15 @@ to_v3d_fence(struct dma_fence *fence)
  #define V3D_GCA_READ(offset) readl(v3d->gca_regs + offset)
  #define V3D_GCA_WRITE(offset, val) writel(val, v3d->gca_regs + offset)
  
@@ -122,7 +122,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  #define V3D_CORE_READ(core, offset) readl(v3d->core_regs[core] + offset)
  #define V3D_CORE_WRITE(core, offset, val) writel(val, v3d->core_regs[core] + offset)
  
-@@ -463,6 +473,7 @@ int v3d_wait_bo_ioctl(struct drm_device
+@@ -461,6 +471,7 @@ int v3d_wait_bo_ioctl(struct drm_device
  		      struct drm_file *file_priv);
  void v3d_job_cleanup(struct v3d_job *job);
  void v3d_job_put(struct v3d_job *job);
diff --git a/target/linux/generic/pending-6.6/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch b/target/linux/generic/pending-6.6/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
index dc42775276..642afec742 100644
--- a/target/linux/generic/pending-6.6/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
+++ b/target/linux/generic/pending-6.6/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/netfilter/nf_tables_api.c
 +++ b/net/netfilter/nf_tables_api.c
-@@ -8530,7 +8530,7 @@ static int nft_register_flowtable_net_ho
+@@ -8528,7 +8528,7 @@ static int nft_register_flowtable_net_ho
  		err = flowtable->data.type->setup(&flowtable->data,
  						  hook->ops.dev,
  						  FLOW_BLOCK_BIND);
diff --git a/target/linux/mediatek/patches-6.6/901-arm-add-cmdline-override.patch b/target/linux/mediatek/patches-6.6/901-arm-add-cmdline-override.patch
index b027a45e8f..1f707fedbd 100644
--- a/target/linux/mediatek/patches-6.6/901-arm-add-cmdline-override.patch
+++ b/target/linux/mediatek/patches-6.6/901-arm-add-cmdline-override.patch
@@ -37,7 +37,7 @@
  	 * CONFIG_CMDLINE is meant to be a default in case nothing else
 --- a/arch/arm64/Kconfig
 +++ b/arch/arm64/Kconfig
-@@ -2360,6 +2360,14 @@ config CMDLINE_FORCE
+@@ -2361,6 +2361,14 @@ config CMDLINE_FORCE
  
  endchoice
  
diff --git a/target/linux/rockchip/patches-6.6/022-v6.15-irqchip-gic-v3-Add-Rockchip-3568002-erratum-workaround.patch b/target/linux/rockchip/patches-6.6/022-v6.15-irqchip-gic-v3-Add-Rockchip-3568002-erratum-workaround.patch
index 146377fc71..76d33b3ebe 100644
--- a/target/linux/rockchip/patches-6.6/022-v6.15-irqchip-gic-v3-Add-Rockchip-3568002-erratum-workaround.patch
+++ b/target/linux/rockchip/patches-6.6/022-v6.15-irqchip-gic-v3-Add-Rockchip-3568002-erratum-workaround.patch
@@ -35,7 +35,7 @@ Link: https://lore.kernel.org/all/20250216221634.364158-2-dmitry.osipenko@collab
  | Fujitsu        | A64FX           | E#010001        | FUJITSU_ERRATUM_010001      |
 --- a/arch/arm64/Kconfig
 +++ b/arch/arm64/Kconfig
-@@ -1318,6 +1318,15 @@ config NVIDIA_CARMEL_CNP_ERRATUM
+@@ -1319,6 +1319,15 @@ config NVIDIA_CARMEL_CNP_ERRATUM
  
  	  If unsure, say Y.
  
diff --git a/target/linux/starfive/patches-6.6/0068-uart-8250-add-reset-operation-in-runtime-PM.patch b/target/linux/starfive/patches-6.6/0068-uart-8250-add-reset-operation-in-runtime-PM.patch
index 1612c47dcd..cbcf3d9b98 100644
--- a/target/linux/starfive/patches-6.6/0068-uart-8250-add-reset-operation-in-runtime-PM.patch
+++ b/target/linux/starfive/patches-6.6/0068-uart-8250-add-reset-operation-in-runtime-PM.patch
@@ -12,7 +12,7 @@ Signed-off-by: William Qiu <william.qiu@starfivetech.com>
 
 --- a/drivers/tty/serial/8250/8250_dw.c
 +++ b/drivers/tty/serial/8250/8250_dw.c
-@@ -747,6 +747,8 @@ static int dw8250_runtime_suspend(struct
+@@ -749,6 +749,8 @@ static int dw8250_runtime_suspend(struct
  {
  	struct dw8250_data *data = dev_get_drvdata(dev);
  
@@ -21,7 +21,7 @@ Signed-off-by: William Qiu <william.qiu@starfivetech.com>
  	clk_disable_unprepare(data->clk);
  
  	clk_disable_unprepare(data->pclk);
-@@ -769,6 +771,8 @@ static int dw8250_runtime_resume(struct
+@@ -771,6 +773,8 @@ static int dw8250_runtime_resume(struct
  		return ret;
  	}
  
diff --git a/target/linux/starfive/patches-6.6/1000-serial-8250_dw-Add-starfive-jh7100-hsuart-compatible.patch b/target/linux/starfive/patches-6.6/1000-serial-8250_dw-Add-starfive-jh7100-hsuart-compatible.patch
index 8372da35c4..d667952a23 100644
--- a/target/linux/starfive/patches-6.6/1000-serial-8250_dw-Add-starfive-jh7100-hsuart-compatible.patch
+++ b/target/linux/starfive/patches-6.6/1000-serial-8250_dw-Add-starfive-jh7100-hsuart-compatible.patch
@@ -15,7 +15,7 @@ Signed-off-by: Emil Renner Berthing <kernel@esmil.dk>
 
 --- a/drivers/tty/serial/8250/8250_dw.c
 +++ b/drivers/tty/serial/8250/8250_dw.c
-@@ -812,6 +812,7 @@ static const struct of_device_id dw8250_
+@@ -814,6 +814,7 @@ static const struct of_device_id dw8250_
  	{ .compatible = "marvell,armada-38x-uart", .data = &dw8250_armada_38x_data },
  	{ .compatible = "renesas,rzn1-uart", .data = &dw8250_renesas_rzn1_data },
  	{ .compatible = "sophgo,sg2044-uart", .data = &dw8250_skip_set_rate_data },