summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-17drm/amdgpu: Limit BO list entry count to prevent resource exhaustionJesse.Zhang
Userspace can pass an arbitrary number of BO list entries via the bo_number field. Although the previous multiplication overflow check prevents out-of-bounds allocation, a large number of entries could still cause excessive memory allocation (up to potentially gigabytes) and unnecessarily long list processing times. Introduce a hard limit of 128k entries per BO list, which is more than sufficient for any realistic use case (e.g., a single list containing all buffers in a large scene). This prevents memory exhaustion attacks and ensures predictable performance. Return -EINVAL if the requested entry count exceeds the limit Reviewed-by: Christian König <christian.koenig@amd.com> Suggested-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332) Cc: stable@vger.kernel.org
2026-03-17drm/amd/display: Fix gamma 2.2 colorop TFsAlex Hung
Use GAMMA22 for degamma/blend and GAMMA22_INV for shaper so curves match the color pipeline. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5016 Tested-by: Xaver Hugl <xaver.hugl@kde.org> Reviewed-by: Melissa Wen <mwen@igalia.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d8f9f42effd767ffa7bbcd7e05fbd6b20737e468)
2026-03-17selftests/mount_setattr: increase tmpfs size for idmapped mount testsChristian Brauner
The mount_setattr_idmapped fixture mounts a 2 MB tmpfs at /mnt and then creates a 2 GB sparse ext4 image at /mnt/C/ext4.img. While ftruncate() succeeds (sparse file), mkfs.ext4 needs to write actual metadata blocks (inode tables, journal, bitmaps) which easily exceeds the 2 MB tmpfs limit, causing ENOSPC and failing the fixture setup for all mount_setattr_idmapped tests. This was introduced by commit d37d4720c3e7 ("selftests/mount_settattr: ensure that ext4 filesystem can be created") which increased the image size from 2 MB to 2 GB but didn't adjust the tmpfs size. Bump the tmpfs size to 256 MB which is sufficient for the ext4 metadata. Fixes: d37d4720c3e7 ("selftests/mount_settattr: ensure that ext4 filesystem can be created") Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-03-17drm/intel: add shared step.h and switch i915 to use itJani Nikula
As the first step towards using shared definitions for step name enumerations, add shared include/drm/intel/step.h and switch i915 to use it. Reviewed-by: Luca Coelho <luciano.coelho@intel.com> Link: https://patch.msgid.link/e76412a316ddff44dc46633d80e9caa5df54ed6b.1773663208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-17drm/xe/compat: remove intel_step_name macroJani Nikula
As there are no more compat users left for intel_step_name(), remove the macro and use the more direct include for the enumerations. Reviewed-by: Luca Coelho <luciano.coelho@intel.com> Link: https://patch.msgid.link/816e3f6dda0a112392e8f8ccff820a81aff63f32.1773663208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-17drm/i915/dmc: use step name from runtime infoJani Nikula
Now that the step name is in runtime info, switch to using it instead of intel_step_name(). The ** are only relevant for DMC, so make their use explicit. Reviewed-by: Luca Coelho <luciano.coelho@intel.com> Link: https://patch.msgid.link/395906e52e76bc726b9dac69a453583cc6e3f6c1.1773663208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-17drm/i915/display: add step name in display runtime infoJani Nikula
Initialize the stepping name in display runtime info. This avoids having to use intel_step_name(). For display device info print at boot, debugfs and snapshot this changes the unknown step name from ** to N/A, which is more user friendly anyway. Reviewed-by: Luca Coelho <luciano.coelho@intel.com> Link: https://patch.msgid.link/aab445dedb8235d9fdddfe2ee5bb624cdf453a18.1773663208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-17drm/i915/dmc: simplify stepping info initializationJani Nikula
Having intel_get_stepping_info() return the pointer that was passed in isn't necessary. Just use a pointer to the local variable instead. The initialization to ** didn't make a difference, because it was always overridden. Reviewed-by: Luca Coelho <luciano.coelho@intel.com> Link: https://patch.msgid.link/c9affb82fd3e9fb464778013bb7c8fab06232bfd.1773663208.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-03-17regulator: fixed: remove unused reboot.h includeHugo Villeneuve
The include was added in commit ecb6f1f45614 ("regulator: fixed: add support for under-voltage IRQ") but it was never used. Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Link: https://patch.msgid.link/20260317152215.3473489-1-hugo@hugovil.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-17remoteproc: xlnx: Release mailbox channels on shutdownTanmay Shah
Mailbox driver can't introduce shutdown callback, as it might endup closing mbox channels prematurely. By allowing the client driver to manage the shutdown process, it's ensured that mailbox channels are closed only when they are no longer needed. Signed-off-by: Tanmay Shah <tanmay.shah@amd.com> Link: https://lore.kernel.org/r/20260303235127.2317955-4-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-03-17regulator: dt-bindings: fix typos in regulator-uv-* descriptionsHugo Villeneuve
Remove word "over". Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Link: https://patch.msgid.link/20260317152357.3473584-1-hugo@hugovil.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-03-17mux: mmio: Zero the allocated memoryKrzysztof Kozlowski
Zero the allocated memory in probe() for fields and hardware states because: 1. The "hardware_states" array is not initialized in the probe, thus starting the device with uninitialized memory. This not a bug, because pointed memory will be assigned in suspend callback, however it is a discouraged coding practice. The "fields" array is initialized shortly further in the probe(). 2. Linux kernel convention for safer code encourages using zeroed allocations, as expressed in memory-allocation.rst document. Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260317152029.274829-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-03-17PCI: endpoint: pci-epf-test: Roll back BAR mapping when subrange setup failsKoichiro Den
When the BAR subrange mapping test on DWC-based platforms fails due to insufficient free inbound iATU regions, pci_epf_test_bar_subrange_setup() returns an error (-ENOSPC) but does not restore the original BAR mapping. This causes subsequent test runs to become confusing, since the failure may leave room for the next subrange mapping test to pass. Fix this by restoring the original BAR mapping when preparation of the subrange mapping fails, so that no side effect remains regardless of the test success or failure. Fixes: 6c5e6101423b ("PCI: endpoint: pci-epf-test: Add BAR subrange mapping test support") Reported-by: Christian Bruel <christian.bruel@foss.st.com> Closes: https://lore.kernel.org/linux-pci/b2b03ebe-9482-4a13-b22f-7b44da096eed@foss.st.com/ Signed-off-by: Koichiro Den <den@valinux.co.jp> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Christian Bruel <christian.bruel@foss.st.com> Reviewed-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260316140225.1481658-1-den@valinux.co.jp
2026-03-17scripts: ver_linux: expand and fix listManuel Ebner
It is a pain in the ass to compare the software versions on the running system (scripts/ver_linux) with the minimal required versions. Sorting both lists the same way makes side-by-side comparisons a simple task. fix path to changes.rst make toolnames uniform with the toolnames in Changes.rst make version commands uniform with Changes.rst Add missing tools in ver_linux bash, bc, bindgen, btrfs-progs, Clang, gdb, GNU awk, GNU tar, GRUB, GRUB2, gtags, iptables, kmod, mcelog, mkimage, openssl, pahole, Python, Rust, Sphinx, squashfs-tools Signed-off-by: Manuel Ebner <manuelebner@airmail.cc> Message-ID: <20260311165440.183672-2-manuelebner@airmail.cc> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2026-03-17cxl/pci: Check memdev driver binding status in cxl_reset_done()Li Ming
cxl_reset_done() accesses the endpoint of the corresponding CXL memdev without endpoint validity checking. By default, cxlmd->endpoint is initialized to -ENXIO, if cxl_reset_done() is triggered after the corresponding CXL memdev probing failed, this results in access to an invalid endpoint. CXL subsystem can always check CXL memdev driver binding status to confirm its endpoint validity. So adding the CXL memdev driver checking inside cxl_reset_done() to avoid accessing an invalid endpoint. Fixes: 934edcd436dc ("cxl: Add post-reset warning if reset results in loss of previously committed HDM decoders") Reviewed-by: Dan Williams <dan.j.williams@intel.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Li Ming <ming.li@zohomail.com> Link: https://patch.msgid.link/20260314-fix_access_endpoint_without_drv_check-v2-4-4c09edf2e1db@zohomail.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-17cxl/pci: Hold memdev lock in cxl_event_trace_record()Li Ming
cxl_event_config() invokes cxl_mem_get_event_record() to get remain event logs from CXL device during cxl_pci_probe(). If CXL memdev probing failed before that, it is possible to access an invalid endpoint. So adding a cxlmd->driver binding status checking inside cxl_dpa_to_region() to ensure the corresponding endpoint is valid. Besides, cxl_event_trace_record() needs to hold memdev lock to invoke cxl_dpa_to_region() to ensure the memdev probing completed. It is possible that cxl_event_trace_record() is invoked during the CXL memdev probing, especially user or cxl_acpi triggers CXL memdev re-probing. Suggested-by: Dan Williams <dan.j.williams@intel.com> Reviewed-by: Dan Williams <dan.j.williams@intel.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Li Ming <ming.li@zohomail.com> Link: https://patch.msgid.link/20260314-fix_access_endpoint_without_drv_check-v2-3-4c09edf2e1db@zohomail.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-03-17docs: pt_BR: add netdev and maintainer handbook translationsDaniel Pereira
Add the Brazilian Portuguese translation for the netdev subsystem process and update the maintainer handbook to include it. Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260312122425.19577-1-danielmaraboo@gmail.com>
2026-03-17docs: interconnect: Document consumer APIs and drop outdated textKuan-Wei Chiu
The documentation currently states that consumer interfaces are not documented, which is no longer true. Remove the outdated claim and include the existing kernel-doc from drivers/interconnect/core.c (filtered for consumer APIs) and drivers/interconnect/bulk.c. Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260312175341.2944154-3-visitorckw@gmail.com>
2026-03-17docs: interconnect: Add provider APIs to documentationKuan-Wei Chiu
The "Interconnect providers" section currently only includes data structures from include/linux/interconnect-provider.h. Include drivers/interconnect/core.c to extract provider-specific API documentation. The :functions: directive is used to prevent mixing with consumer APIs. Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260312175341.2944154-2-visitorckw@gmail.com>
2026-03-17drm/amdgpu/atomfirmware: Add LpDDR5x and new fields for info v2_3Leo Li
[Why] Newer DCN bandwidth calculations require new definitions. [How] Add new fields cpu_id and vram_bit_width for atom_integrated_system_info_v2_3, and add a memtype for LpDDR5x. Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Leo Li <sunpeng.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu: Fix ISP segfault issue in kernel v7.0Pratap Nirujogi
Add NULL pointer checks for dev->type before accessing dev->type->name in ISP genpd add/remove functions to prevent kernel crashes. This regression was introduced in v7.0 as the wakeup sources are registered using physical device instead of ACPI device. This led to adding wakeup source device as the first child of AMDGPU device without initializing dev-type variable, and resulted in segfault when accessed it in the amdgpu isp driver. Fixes: 057edc58aa59 ("ACPI: PM: Register wakeup sources under physical devices") Suggested-by: Bin Du <Bin.Du@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Pratap Nirujogi <pratap.nirujogi@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu/gmc9.0: add bounds checking for cidAlex Deucher
The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Cc: Benjamin Cheng <benjamin.cheng@amd.com> Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu/mmhub4.2.0: add bounds checking for cidAlex Deucher
The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu/mmhub4.1.0: add bounds checking for cidAlex Deucher
The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu/mmhub3.0: add bounds checking for cidAlex Deucher
The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu/mmhub3.0.2: add bounds checking for cidAlex Deucher
The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu/mmhub3.0.1: add bounds checking for cidAlex Deucher
The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu/mmhub2.3: add bounds checking for cidAlex Deucher
The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu/mmhub2.0: add bounds checking for cidAlex Deucher
The value should never exceed the array size as those are the only values the hardware is expected to return, but add checks anyway. Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu: Add default case in DVI mode validationSrinivasan Shanmugam
amdgpu_connector_dvi_mode_valid() assigns max_digital_pixel_clock_khz based on connector_object_id using a switch statement that lacks a default case. In practice this code path should never be hit because the existing cases already cover all digital connector types that this function is used for. This is also legacy display code which is not used for new hardware. Add a default case returning MODE_BAD to make the switch exhaustive and silence the static analyzer smatch error. The new branch is effectively defensive and should never be reached during normal operation. Fixes: 585b2f685c56 ("drm/amdgpu: Respect max pixel clock for HDMI and DVI-D (v2)") Cc: Dan Carpenter <dan.carpenter@linaro.org> Cc: Timur Kristóf <timur.kristof@gmail.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amd/ras: Fix NULL deref in ras_core_ras_interrupt_detected()Srinivasan Shanmugam
Fixes a NULL pointer dereference when ras_core is NULL and ras_core->dev is accessed in the error path. Fixes: 13c91b5b4378 ("drm/amd/ras: Add rascore unified interface function") Reported by: Dan Carpenter <dan.carpenter@linaro.org> Cc: YiPeng Chai <YiPeng.Chai@amd.com> Cc: Tao Zhou <tao.zhou1@amd.com> Cc: Hawking Zhang <Hawking.Zhang@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu: Drop unreachable return in amdgpu_reg_get_smn_base64()Srinivasan Shanmugam
amdgpu_reg_get_smn_base64() returns from all control-flow paths inside the !adev->reg.smn.get_smn_base fallback path. For version == 1, the function returns the base address from amdgpu_reg_smn_v1_0_get_base(). For all other versions, the default switch branch emits a dev_err_once() and returns 0. The trailing return 0 after the switch is therefore unreachable and is reported by Smatch as dead code: drivers/gpu/drm/amd/amdgpu/amdgpu_reg_access.c:317 amdgpu_reg_get_smn_base64() warn: ignoring unreachable code Remove the redundant return statement. Fixes: 467ebfe65f6e ("drm/amdgpu: Add smn callbacks to register block") Cc: Dan Carpenter <dan.carpenter@linaro.org> Cc: Lijo Lazar <lijo.lazar@amd.com> Cc: Hawking Zhang <Hawking.Zhang@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu: validate fence_count in wait_fences ioctlJesse.Zhang
Add an early parameter check in amdgpu_cs_wait_fences_ioctl() to reject a zero fence_count with -EINVAL. dma_fence_wait_any_timeout() requires count > 0. When userspace passes fence_count == 0, the call propagates down to dma_fence core which does not expect a zero-length array and triggers a WARN_ON. Return -EINVAL immediately so the caller gets a clear error instead of hitting an unexpected warning in the DMA fence subsystem. No functional change for well-formed userspace callers. v2: - Reworked commit message to clarify the parameter validation rationale - Removed verbose crash log from commit description - Simplified inline code comment Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu: move devcoredump generation to a workerPierre-Eric Pelloux-Prayer
Update the way drm_coredump_printer is used based on its documentation and Xe's code: the main idea is to generate the final version in one go and then use memcpy to return the chunks requested by the caller of amdgpu_devcoredump_read. The generation is moved to a separate worker thread. This cuts the time to copy the dump from 40s to ~0s on my machine. --- v3: - removed adev->coredump_in_progress and instead use work as the synchronisation mechanism - use kvfree instead of kfree --- Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17jobserver: Fix typo in docstringRicardo Ungerer
This commit fixes small typos in the docstring of jobserver.py. Signed-off-by: Ricardo Ungerer <ungerer.ricardo@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260316220218.568022-1-ungerer.ricardo@gmail.com>
2026-03-17drm/amd/amdgpu: Fix build errors due to declarations after labelsJesse.Zhang
In C90 (which the kernel uses with -std=gnu89), declarations must appear at the beginning of a block and cannot follow a label. The switch cases in amdgpu_discovery.c and gmc_v12_1.c contained variable declarations immediately after case labels, causing the compiler to error: drivers/gpu/drm/amd/amdgpu/gmc_v12_1.c:533:3: error: a label can only be part of a statement and a declaration is not a statement Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu/userq: unlock cancel_delayed_work_sync for hang_detect_workSunil Khatri
cancel_delayed_work_sync for work hand_detect_work should not be locked since the amdgpu_userq_hang_detect_work also need the same mutex and when they run together it could be a deadlock. we do not need to hold the mutex for cancel_delayed_work_sync(&queue->hang_detect_work). With this in place if cancel and worker thread run at same time they will not deadlock. Due to any failures if there is a hand detect and reset that there a deadlock scenarios between cancel and running the main thread. [ 243.118276] task:kworker/9:0 state:D stack:0 pid:73 tgid:73 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 243.118283] Workqueue: events amdgpu_userq_hang_detect_work [amdgpu] [ 243.118636] Call Trace: [ 243.118639] <TASK> [ 243.118644] __schedule+0x581/0x1810 [ 243.118649] ? srso_return_thunk+0x5/0x5f [ 243.118656] ? srso_return_thunk+0x5/0x5f [ 243.118659] ? wake_up_process+0x15/0x20 [ 243.118665] schedule+0x64/0xe0 [ 243.118668] schedule_preempt_disabled+0x15/0x30 [ 243.118671] __mutex_lock+0x346/0x950 [ 243.118677] __mutex_lock_slowpath+0x13/0x20 [ 243.118681] mutex_lock+0x2c/0x40 [ 243.118684] amdgpu_userq_hang_detect_work+0x63/0x90 [amdgpu] [ 243.118888] process_scheduled_works+0x1f0/0x450 [ 243.118894] worker_thread+0x27f/0x370 [ 243.118899] kthread+0x1ed/0x210 [ 243.118903] ? __pfx_worker_thread+0x10/0x10 [ 243.118906] ? srso_return_thunk+0x5/0x5f [ 243.118909] ? __pfx_kthread+0x10/0x10 [ 243.118913] ret_from_fork+0x10f/0x1b0 [ 243.118916] ? __pfx_kthread+0x10/0x10 [ 243.118920] ret_from_fork_asm+0x1a/0x30 Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu/userq: fix dma_fence refcount underflow in userq pathSunil Khatri
An extra dma_fence_put() can drop the last reference to a fence while it is still attached to a dma_resv object. This frees the fence prematurely via dma_fence_release() while other users still hold the pointer. Later accesses through dma_resv iteration may then operate on the freed fence object, leading to refcount underflow warnings and potential hangs when walking reservation fences. Fix this by correcting the fence lifetime so the dma_resv object retains a valid reference until it is done with the fence.i [ 31.133803] refcount_t: underflow; use-after-free. [ 31.133805] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x58/0x90, CPU#18: kworker/u96:1/188 Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu: fallback to default discovery offset/size in sriov guestHawking Zhang
In SRIOV guest environment, if dynamic critical region is not enabled, fallback to default discovery offset and size to ensure proper initialization Signed-off-by: Hawking Zhang <Hawking.Zhang@amd.com> Reviewed-by: Likun Gao <Likun.Gao@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17docs: memory-hotplug: fix typo 'fo' -> 'for' in NODE_ADDED_FIRST_MEMORY ↵Praveen Kumar Singh
description The description of NODE_ADDED_FIRST_MEMORY notification contains a missing 'r' in the word 'for'. Fix the typo. Signed-off-by: Praveen Kumar Singh <pr4veensingh@proton.me> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <by7jSPCep0WcWKD6nntH0wGbcN59hRhsEOc2lHBps2QizxRtedH25CdW8DO33YiqJU3Y7kGWesJnBts-jvgMzNqDvLWH3cTDYpJPuNed9hU=@proton.me>
2026-03-17drm/amdgpu/userq: Use kvfree instead of kfree in amdgpu_userq_signal_ioctlSunil Khatri
In function amdgpu_userq_signal_ioctl, drm_gem_objects_lookup allocates memory via kvmalloc and hence when that memory is freed the memory via kvfree. Fixes: 4ca06f6fb45d ("drm/amdgpu/userq: Use drm_gem_objects_lookup in amdgpu_userq_signal_ioctl") Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu: update flip bit setting of RAS bad pageTao Zhou
The flip bit setting is different if umc number is half of original configuration. v2: block the flip bit setting for unsupported umc configuration. Signed-off-by: Tao Zhou <tao.zhou1@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amdgpu: Replace deprecated strcpy() in amdgpu_virt_write_vf2pf_dataYicong Hui
strcpy() is deprecated as it does not do any bounds checking (as specified in Documentation/process/deprecated.rst). There is a risk of buffer overflow in the case that the value for THIS_MODULE->version exceeds the 64 characters. This is unlikely, but replacing the deprecated function will pre-emptively remove this risk entirely. Replace both instances of strcpy() with the safer strscpy() function. Changes have been compile tested. Reviewed-by: Kees Cook <kees@kernel.org> Signed-off-by: Yicong Hui <yiconghui@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amd: fix dcn 2.01 checkAndy Nguyen
The ASICREV_IS_BEIGE_GOBY_P check always took precedence, because it includes all chip revisions upto NV_UNKNOWN. Fixes: 54b822b3eac3 ("drm/amd/display: Use dce_version instead of chip_id") Signed-off-by: Andy Nguyen <theofficialflow1996@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr()Srinivasan Shanmugam
parse_edid_displayid_vrr() searches the EDID extension blocks for a DisplayID extension before parsing the dynamic video timing range. The code previously checked whether edid_ext was NULL after the search loop. However, edid_ext is assigned during each iteration of the loop, so it will never be NULL once the loop has executed. If no DisplayID extension is found, edid_ext ends up pointing to the last extension block, and the NULL check does not correctly detect the failure case. Instead, check whether the loop completed without finding a matching DisplayID block by testing "i == edid->extensions". This ensures the function exits early when no DisplayID extension is present and avoids parsing an unrelated EDID extension block. Also simplify the EDID validation check using "!edid || !edid->extensions". Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm.c:13079 parse_edid_displayid_vrr() warn: variable dereferenced before check 'edid_ext' (see line 13075) Fixes: a638b837d0e6 ("drm/amd/display: Fix refresh rate range for some panel") Cc: Roman Li <roman.li@amd.com> Cc: Alex Hung <alex.hung@amd.com> Cc: Jerry Zuo <jerry.zuo@amd.com> Cc: Sun peng Li <sunpeng.li@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Cc: Dan Carpenter <dan.carpenter@linaro.org> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/amd/display: remove duplicate format modifierErik Kurzinger
amdgpu_dm_plane_get_plane_modifiers always adds DRM_FORMAT_MOD_LINEAR to the list of modifiers. However, with gfx12, amdgpu_dm_plane_add_gfx12_modifiers also adds that modifier to the list. So we end up with two copies. Most apps just ignore this but some (Weston) don't like it. As a fix, we change amdgpu_dm_plane_add_gfx12_modifiers to not add DRM_FORMAT_MOD_LINEAR to the list, matching the behavior of analogous functions for other chips. Signed-off-by: Erik Kurzinger <ekurzinger@gmail.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17drm/pagemap_util: Ensure proper cache lock management on freeJonathan Cavitt
For the sake of consistency, ensure that the cache lock is always unlocked after drm_pagemap_cache_fini. Spinlocks typically disable preemption and if the code-path missing the unlock is hit, preemption will remain disabled even if the lock is subsequently freed. Fixes static analysis issue. v2: - Use requested code flow (Maarten) v3: - Clear cache->dpagemap (Matt Brost, Maarten) v4: - Reword commit message (Thomas) Fixes: 77f14f2f2d73f ("drm/pagemap: Add a drm_pagemap cache and shrinker") Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/20260316151555.7553-2-jonathan.cavitt@intel.com
2026-03-17drm/amdgpu: switch XGMI sysfs show helpers to sysfs_emit_at()David Baum
The XGMI sysfs show helpers amdgpu_xgmi_show_num_hops() and amdgpu_xgmi_show_num_links() currently populate the output buffer with sprintf() and then call sysfs_emit(buf, "%s\n", buf) to append the final newline. Convert both helpers to use sysfs_emit_at() while tracking the current offset. This keeps buffer construction in the sysfs helpers, avoids feeding the output buffer back into the final formatted write, and matches the style already used by amdgpu_xgmi_show_connected_port_num(). Signed-off-by: David Baum <davidbaum461@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17Merge patch series "vfs: follow-on fixes for i_ino widening"Christian Brauner
Jeff Layton <jlayton@kernel.org> says: Just some patches to fix follow-on issues reported after the inode->i_ino widening series. * patches from https://patch.msgid.link/20260316-iino-u64-v3-0-d1076b8f7a20@kernel.org: nilfs2: fix 64-bit division operations in nilfs_bmap_find_target_in_group() EVM: add comment describing why ino field is still unsigned long Link: https://patch.msgid.link/20260316-iino-u64-v3-0-d1076b8f7a20@kernel.org Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-03-17nilfs2: fix 64-bit division operations in nilfs_bmap_find_target_in_group()Jeff Layton
With the change to make inode->i_ino a u64, the build started failing on 32-bit ARM with: ERROR: modpost: "__aeabi_uldivmod" [fs/nilfs2/nilfs2.ko] undefined! Fix this by using udiv_u64() for the division. For finding the index into the group, switch to using a bitwise & operation since that's more efficient. With this change however, NILFS_BMAP_GROUP_DIV must be a power of two, so add a compile-time assertion for that. Fixes: 998a59d371c2 ("treewide: fix missed i_ino format specifier conversions") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202603100602.KPxiClIO-lkp@intel.com/ Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com> Acked-by: Ryusuke Konishi <konishi.ryusuke@gmail.com> Signed-off-by: Jeff Layton <jlayton@kernel.org> Link: https://patch.msgid.link/20260316-iino-u64-v3-2-d1076b8f7a20@kernel.org Signed-off-by: Christian Brauner <brauner@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-17 01:29:37 +0000