linux.git/drivers/gpu/drm/amd/pm/amdgpu_pm.c, branch v7.2

drm/amd/pm: use milliwatts for GPU power sensors

2026-07-29T00:01:06+00:00

GPU average and input power backends report a mix of whole watts,
milliwatts, Q24.8 watts and decimal-packed fractions. Q24.8 is inherited
from the legacy PowerPlay sensor format. Milliwatts are a more natural unit
for the hwmon and pm_info consumers in amdgpu_pm.c. A common decoder cannot
distinguish these formats, and converting native milliwatts through Q24.8
also loses precision.

Use milliwatts as the internal unit across all PPT and PowerPlay backends.
Decode Q24.8 only at the legacy smu7 input boundary and encode it only for
the raw amdgpu_sensors debugfs interface. This gives hwmon, pm_info and the
sensor ioctl one unambiguous unit while preserving the format used by UMR.

Fixes: 5b79d0482f3c ("drm/amd/pp: Remove struct pp_gpu_power")
Fixes: 01992b121fb6 ("drm/amd/pm: fix amdgpu_pm_info power display units")
Signed-off-by: Yang Wang 
Reviewed-by: Kenneth Feng 
Reported-by: Lars Nieradzik 
Signed-off-by: Alex Deucher 
(cherry picked from commit 757ba0790bafec47a507e9662bf380f2e027d420)
Cc: stable@vger.kernel.org

drm/amd/pm: fix torn gpu metrics reads

2026-07-29T00:00:06+00:00

amdgpu_dpm_get_gpu_metrics() returns a pointer to the shared metrics cache
after dropping adev->pm.mutex. The sysfs path then copies from that pointer.
Another reader can refresh the cache in place during the copy and return a
snapshot containing data from two generations.

Pass caller-provided storage through the DPM interface and copy the metrics
while the mutex is held. This keeps the cache pointer private and makes each
sysfs read observe one complete sample.

Fixes: 25c933b1c4fc ("drm/amd/powerplay: add new sysfs interface for retrieving gpu metrics(V2)")
Signed-off-by: Yang Wang 
Reviewed-by: Kenneth Feng 
Signed-off-by: Alex Deucher 
(cherry picked from commit 862333bb48693ecafcae25af0c9d9ec31015ac77)
Cc: stable@vger.kernel.org

drm/amd/pm: fix pptable use-after-free

2026-07-28T23:59:59+00:00

amdgpu_dpm_get_pp_table() returns a pointer to a driver-owned power table
after dropping adev->pm.mutex. The sysfs path then copies from that pointer.
A concurrent pp_table write can replace and free the allocation during the
copy, causing a use-after-free.

Change the DPM interface to copy into caller-provided storage while the mutex
is held. Keep the size-only query for attribute discovery without exposing
the driver-owned pointer.

Fixes: 1684d3ba4885 ("drm/amd/amdgpu: change pptable output format from ASCII to binary")
Signed-off-by: Yang Wang 
Reviewed-by: Kenneth Feng 
Signed-off-by: Alex Deucher 
(cherry picked from commit f6eed7acfd30099ef7baeb6ba45bb59daad80631)
Cc: stable@vger.kernel.org

drm/amd/pm: fix amdgpu_pm_info power display units

2026-07-01T16:58:16+00:00

amdgpu_pm_info displayed power sensor readings with the wrong fractional unit.
It treated the low byte of the raw sensor value as the decimal part of watts,
while that field represents milliwatts in the decoded value. As a result,
debugfs could report misleading SoC power when the remainder was not already
a two-digit centiwatt value.

Example with query = 0x00000354:

  raw field        value
  ---------------------
  query >> 8       3 W
  query & 0xff     84 mW
  decoded power    3084 mW

  output           value
  ---------------------
  before           3.84 W
  after            3.08 W

Fixes: f0b8f65b4825 ("drm/amd/amdgpu: fix the GPU power print error in pm info")
Signed-off-by: Yang Wang 
Reviewed-by: Asad Kamal 
Signed-off-by: Alex Deucher 
(cherry picked from commit 01992b121fb652c753d37e0c1427a2d1a557d2b1)
Cc: stable@vger.kernel.org

drm/amd/pm: make pp_features read-only when scpm is enabled

2026-07-01T16:58:13+00:00

SCPM owns power feature control when enabled.

Make pp_features read-only during sysfs setup by clearing its write bits
and store callback.

Signed-off-by: Yang Wang 
Reviewed-by: Asad Kamal 
Signed-off-by: Alex Deucher 
(cherry picked from commit 6a5786e191fdce36c5db170e5209cf609e8f0087)
Cc: stable@vger.kernel.org

drm/amd/pm: Use strscpy in profile mode parsing

2026-06-04T19:27:55+00:00

Use strscpy to copy the buffer which makes it explicit that a valid NULL
terminated string gets copied. Also, make it explicit that the source
buffer can be copied safely to the temporary buffer by checking against
its size.

Signed-off-by: Lijo Lazar 
Reviewed-by: Hawking Zhang 
Signed-off-by: Alex Deucher

drm/amd/pm: bound OD parameter parsing to stack array size

2026-06-04T19:26:01+00:00

Reject inputs once parameter_size reaches the array limit, and pass
ARRAY_SIZE(parameter) into parse_input_od_command_lines() for defense in
depth.

Signed-off-by: Candice Li 
Reviewed-by: Hawking Zhang 
Signed-off-by: Alex Deucher

drm/amd/pm: Stop pp_od_clk_voltage emit at PAGE_SIZE

2026-06-04T19:25:58+00:00

Stop appending OD sections in amdgpu_get_pp_od_clk_voltage()
once the sysfs page is full, instead of checking every sysfs_emit_at()
in SMU helpers. This is purely defensive hardening.

v2: Drop the prior series that checked sysfs_emit_at()
return values in every SMU *_emit_clk_levels() helper and
smu_cmn_print_*().(Kevin)

v3: Update description, remove all clamping

Signed-off-by: Asad Kamal 
Reviewed-by: Yang Wang 
Reviewed-by: Lijo Lazar 
Signed-off-by: Alex Deucher

drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error

2026-06-03T17:52:52+00:00

Return the parse error before acquiring PM access.

Signed-off-by: Candice Li 
Reviewed-by: Hawking Zhang 
Signed-off-by: Alex Deucher

drm/amd/pm: Reject negative values in thermal_throttling_logging

2026-06-03T17:52:23+00:00

Discovery: Fuzzing for secure supply chain requirements
Tool: amd_fuzzing_sysfs (IGT test)

The thermal_throttling_logging sysfs store function accepts negative
values like -1 and -9999999, which are nonsensical for a logging interval.

Current behavior:
- Values <= 0 disable logging (intended for 0 only)
- Values 1-3600 enable logging with interval in seconds
- Negative values are accepted and treated as disable

Issue:
Large negative values like -9999999 make no semantic sense and could
indicate input validation bypass attempts. While they functionally
disable logging (same as 0), accepting arbitrary negative values
suggests inadequate input validation.

Fix:
Add explicit check to reject values < 0 before processing.
Only accept:
- 0: disable thermal throttling logging
- 1-3600: enable with interval in seconds (existing validation)

This improves input validation and makes the interface more robust.

Test Results Before Fix:
  thermal_throttling_logging: 6 failures
  - Accepted: 0, -1, -9999999, -2147483648, empty string, 0777

Test Results After Fix:
  thermal_throttling_logging: 3 failures
  - Rejected: -1, -9999999, -2147483648 (now return -EINVAL)
  - Remaining: empty string (VFS behavior), 0 (valid), 0777 (octal)

Tested: amd_fuzzing_sysfs IGT test

Cc: Christian König 
Cc: Alex Deucher 
Cc: Jesse Zhang 

Signed-off-by: Vitaly Prosyak 
Reviewed-by: Alex Deucher 
Signed-off-by: Alex Deucher