--- /dev/null
+From 238baca26a6279e688d1a156bd031390b82eb578 Mon Sep 17 00:00:00 2001
+From: Yang Wang <kevinyang.wang@amd.com>
+Date: Thu, 18 Jun 2026 12:54:14 +0800
+Subject: drm/amd/pm: fix amdgpu_pm_info power display units
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+commit 238baca26a6279e688d1a156bd031390b82eb578 upstream.
+
+amdgpu_pm_info displayed power sensor readings with the wrong fractional unit.
+It treated the low byte of the raw sensor value as the decimal part of watts,
+while that field represents milliwatts in the decoded value. As a result,
+debugfs could report misleading SoC power when the remainder was not already
+a two-digit centiwatt value.
+
+Example with query = 0x00000354:
+
+ raw field value
+ ---------------------
+ query >> 8 3 W
+ query & 0xff 84 mW
+ decoded power 3084 mW
+
+ output value
+ ---------------------
+ before 3.84 W
+ after 3.08 W
+
+Fixes: f0b8f65b4825 ("drm/amd/amdgpu: fix the GPU power print error in pm info")
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 01992b121fb652c753d37e0c1427a2d1a557d2b1)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_pm.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+@@ -40,6 +40,8 @@
+
+ #define DEVICE_ATTR_IS(_name) (attr_id == device_attr_id__##_name)
+
++#define power_2_mwatt(power) (((power) >> 8) * 1000 + ((power) & 0xff))
++
+ struct od_attribute {
+ struct kobj_attribute attribute;
+ struct list_head entry;
+@@ -3261,7 +3263,6 @@ static int amdgpu_hwmon_get_power(struct
+ enum amd_pp_sensors sensor)
+ {
+ struct amdgpu_device *adev = dev_get_drvdata(dev);
+- unsigned int uw;
+ u32 query = 0;
+ int r;
+
+@@ -3270,9 +3271,7 @@ static int amdgpu_hwmon_get_power(struct
+ return r;
+
+ /* convert to microwatts */
+- uw = (query >> 8) * 1000000 + (query & 0xff) * 1000;
+-
+- return uw;
++ return power_2_mwatt(query) * 1000;
+ }
+
+ static ssize_t amdgpu_hwmon_show_power_avg(struct device *dev,
+@@ -4804,7 +4803,7 @@ static int amdgpu_debugfs_pm_info_pp(str
+ {
+ uint32_t mp1_ver = amdgpu_ip_version(adev, MP1_HWIP, 0);
+ uint32_t gc_ver = amdgpu_ip_version(adev, GC_HWIP, 0);
+- uint32_t value;
++ uint32_t value, mwatt, centiwatt;
+ uint64_t value64 = 0;
+ uint32_t query = 0;
+ int size;
+@@ -4829,17 +4828,21 @@ static int amdgpu_debugfs_pm_info_pp(str
+ seq_printf(m, "\t%u mV (VDDNB)\n", value);
+ size = sizeof(uint32_t);
+ if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GPU_AVG_POWER, (void *)&query, &size)) {
++ mwatt = power_2_mwatt(query);
++ centiwatt = DIV_ROUND_CLOSEST(mwatt, 10);
+ if (adev->flags & AMD_IS_APU)
+- seq_printf(m, "\t%u.%02u W (average SoC including CPU)\n", query >> 8, query & 0xff);
++ seq_printf(m, "\t%u.%02u W (average SoC including CPU)\n", centiwatt / 100, centiwatt % 100);
+ else
+- seq_printf(m, "\t%u.%02u W (average SoC)\n", query >> 8, query & 0xff);
++ seq_printf(m, "\t%u.%02u W (average SoC)\n", centiwatt / 100, centiwatt % 100);
+ }
+ size = sizeof(uint32_t);
+ if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GPU_INPUT_POWER, (void *)&query, &size)) {
++ mwatt = power_2_mwatt(query);
++ centiwatt = DIV_ROUND_CLOSEST(mwatt, 10);
+ if (adev->flags & AMD_IS_APU)
+- seq_printf(m, "\t%u.%02u W (current SoC including CPU)\n", query >> 8, query & 0xff);
++ seq_printf(m, "\t%u.%02u W (current SoC including CPU)\n", centiwatt / 100, centiwatt % 100);
+ else
+- seq_printf(m, "\t%u.%02u W (current SoC)\n", query >> 8, query & 0xff);
++ seq_printf(m, "\t%u.%02u W (current SoC)\n", centiwatt / 100, centiwatt % 100);
+ }
+ size = sizeof(value);
+ seq_printf(m, "\n");
--- /dev/null
+From 53c78ab388bfc1a4d72e756815d0db0a842c812e Mon Sep 17 00:00:00 2001
+From: Yang Wang <kevinyang.wang@amd.com>
+Date: Fri, 12 Jun 2026 10:55:09 +0800
+Subject: drm/amd/pm: make pp_features read-only when scpm is enabled
+
+From: Yang Wang <kevinyang.wang@amd.com>
+
+commit 53c78ab388bfc1a4d72e756815d0db0a842c812e upstream.
+
+SCPM owns power feature control when enabled.
+
+Make pp_features read-only during sysfs setup by clearing its write bits
+and store callback.
+
+Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
+Reviewed-by: Asad Kamal <asad.kamal@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 6a5786e191fdce36c5db170e5209cf609e8f0087)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+@@ -2619,6 +2619,11 @@ static int default_attr_update(struct am
+ gc_ver != IP_VERSION(9, 4, 3)) ||
+ gc_ver < IP_VERSION(9, 0, 0))
+ *states = ATTR_STATE_UNSUPPORTED;
++
++ if (adev->scpm_enabled) {
++ dev_attr->attr.mode &= ~S_IWUGO;
++ dev_attr->store = NULL;
++ }
+ } else if (DEVICE_ATTR_IS(gpu_metrics)) {
+ if (gc_ver < IP_VERSION(9, 1, 0))
+ *states = ATTR_STATE_UNSUPPORTED;
--- /dev/null
+From ea772a440d56b285f4d491affac50ecd41f6b402 Mon Sep 17 00:00:00 2001
+From: Asad Kamal <asad.kamal@amd.com>
+Date: Sun, 14 Jun 2026 12:50:28 +0800
+Subject: drm/amdgpu: fix aperture mapping leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Asad Kamal <asad.kamal@amd.com>
+
+commit ea772a440d56b285f4d491affac50ecd41f6b402 upstream.
+
+amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver
+fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to
+always return false, so iounmap(aper_base_kaddr) never runs on normal
+driver unload, leaving an orphaned entry in the x86 PAT interval tree.
+
+On connected_to_cpu hardware, the aperture is mapped write-back (WB) via
+ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC)
+over the same range. The WC vs WB conflict causes:
+
+ ioremap error for 0x..., requested 0x1, got 0x0
+ amdgpu: discovery failed: -2
+
+Fix by switching to devres-managed mappings so cleanup is guaranteed
+regardless of drm_dev_enter() state:
+
+- connected_to_cpu path: devm_memremap(MEMREMAP_WB). For
+ IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut,
+ returning __va(offset) from the existing kernel direct map. No new
+ ioremap VA or PAT entry is created, so there is nothing to orphan.
+
+- dGPU path: devm_ioremap_wc() registers iounmap() as a devres action,
+ guaranteeing cleanup at device_del() time.
+
+Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio()
+since the mapping is now devres-owned.
+
+v2: Remove redundant x86_64 guard (Lijo)
+
+Fixes: 9d0af8b4def0 ("drm/amdgpu: pre-map device buffer as cached for A+A config")
+Signed-off-by: Asad Kamal <asad.kamal@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 -
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 36 ++++++++++++-----------------
+ 2 files changed, 16 insertions(+), 22 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4946,8 +4946,6 @@ static void amdgpu_device_unmap_mmio(str
+
+ iounmap(adev->rmmio);
+ adev->rmmio = NULL;
+- if (adev->mman.aper_base_kaddr)
+- iounmap(adev->mman.aper_base_kaddr);
+ adev->mman.aper_base_kaddr = NULL;
+
+ /* Memory manager related */
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -1980,18 +1980,23 @@ int amdgpu_ttm_init(struct amdgpu_device
+ /* Change the size here instead of the init above so only lpfn is affected */
+ amdgpu_ttm_set_buffer_funcs_status(adev, false);
+ #ifdef CONFIG_64BIT
+-#ifdef CONFIG_X86
+- if (adev->gmc.xgmi.connected_to_cpu)
+- adev->mman.aper_base_kaddr = ioremap_cache(adev->gmc.aper_base,
+- adev->gmc.visible_vram_size);
+-
+- else if (adev->gmc.is_app_apu)
++ if (adev->gmc.xgmi.connected_to_cpu) {
++ void *kaddr = devm_memremap(adev->dev, adev->gmc.aper_base,
++ adev->gmc.visible_vram_size,
++ MEMREMAP_WB);
++ if (IS_ERR(kaddr))
++ return PTR_ERR(kaddr);
++ adev->mman.aper_base_kaddr = (__force void __iomem *)kaddr;
++ } else if (adev->gmc.is_app_apu) {
+ DRM_DEBUG_DRIVER(
+ "No need to ioremap when real vram size is 0\n");
+- else
+-#endif
+- adev->mman.aper_base_kaddr = ioremap_wc(adev->gmc.aper_base,
+- adev->gmc.visible_vram_size);
++ } else {
++ adev->mman.aper_base_kaddr = devm_ioremap_wc(adev->dev,
++ adev->gmc.aper_base,
++ adev->gmc.visible_vram_size);
++ if (!adev->mman.aper_base_kaddr)
++ return -ENOMEM;
++ }
+ #endif
+
+ /*
+@@ -2152,8 +2157,6 @@ int amdgpu_ttm_init(struct amdgpu_device
+ */
+ void amdgpu_ttm_fini(struct amdgpu_device *adev)
+ {
+- int idx;
+-
+ if (!adev->mman.initialized)
+ return;
+
+@@ -2180,14 +2183,7 @@ void amdgpu_ttm_fini(struct amdgpu_devic
+ amdgpu_ttm_fw_reserve_vram_fini(adev);
+ amdgpu_ttm_drv_reserve_vram_fini(adev);
+
+- if (drm_dev_enter(adev_to_drm(adev), &idx)) {
+-
+- if (adev->mman.aper_base_kaddr)
+- iounmap(adev->mman.aper_base_kaddr);
+- adev->mman.aper_base_kaddr = NULL;
+-
+- drm_dev_exit(idx);
+- }
++ adev->mman.aper_base_kaddr = NULL;
+
+ if (!adev->gmc.is_app_apu)
+ amdgpu_vram_mgr_fini(adev);
--- /dev/null
+From 0c01c811be47e6b146552dd59bfedbea8f09b8f4 Mon Sep 17 00:00:00 2001
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+Date: Tue, 12 May 2026 10:29:36 -0400
+Subject: drm/amdgpu: fix division by zero with invalid uvd dimensions
+
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+
+commit 0c01c811be47e6b146552dd59bfedbea8f09b8f4 upstream.
+
+When width or height is less than 16, width_in_mb or height_in_mb
+becomes 0, leading to fs_in_mb being 0. This causes a division by
+zero when calculating num_dpb_buffer in H264 and H264 Perf decode
+paths.
+
+Add validation to reject frames with width < 16 or height < 16
+before performing any calculations that depend on these values.
+
+V2: Format change - move up all vaiable definitions.
+V3: Use warn_once to avoid spam.
+
+Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 3e41d26c70b0a459d041cc19482a226c4b7423cb)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+@@ -654,6 +654,14 @@ static int amdgpu_uvd_cs_msg_decode(stru
+ unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer;
+ unsigned int min_ctx_size = ~0;
+
++ /* Reject invalid dimensions to prevent division by zero */
++ if (width < 16 || height < 16) {
++ dev_WARN_ONCE(adev->dev, 1,
++ "Invalid UVD decoding dimensions (%dx%d)!\n",
++ width, height);
++ return -EINVAL;
++ }
++
+ image_size = width * height;
+ image_size += image_size / 2;
+ image_size = ALIGN(image_size, 1024);
--- /dev/null
+From 020da7c5aac5b86bad8a1571f6eda6b8cff9331d Mon Sep 17 00:00:00 2001
+From: Ce Sun <cesun102@amd.com>
+Date: Mon, 22 Jun 2026 23:05:09 +0800
+Subject: drm/amdgpu: fix resource leak on ACP reset timeout
+
+From: Ce Sun <cesun102@amd.com>
+
+commit 020da7c5aac5b86bad8a1571f6eda6b8cff9331d upstream.
+
+When ACP soft reset poll times out, original code returns early without cleanup,
+leaking MFD child devices, genpd links and all ACP heap allocations.
+
+Replace direct early return with goto out to force run all cleanup logic
+regardless of reset success, preserve timeout error code for caller.
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 98073e4328d7a8d75d03696ab27f6de70ef1aeda)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+@@ -505,6 +505,7 @@ static int acp_hw_fini(struct amdgpu_ip_
+ u32 val = 0;
+ u32 count = 0;
+ struct amdgpu_device *adev = ip_block->adev;
++ int ret = 0;
+
+ /* return early if no ACP */
+ if (!adev->acp.acp_genpd) {
+@@ -526,7 +527,8 @@ static int acp_hw_fini(struct amdgpu_ip_
+ break;
+ if (--count == 0) {
+ dev_err(&adev->pdev->dev, "Failed to reset ACP\n");
+- return -ETIMEDOUT;
++ ret = -ETIMEDOUT;
++ goto out;
+ }
+ udelay(100);
+ }
+@@ -543,11 +545,12 @@ static int acp_hw_fini(struct amdgpu_ip_
+ break;
+ if (--count == 0) {
+ dev_err(&adev->pdev->dev, "Failed to reset ACP\n");
+- return -ETIMEDOUT;
++ ret = -ETIMEDOUT;
++ goto out;
+ }
+ udelay(100);
+ }
+-
++out:
+ device_for_each_child(adev->acp.parent, NULL,
+ acp_genpd_remove_device);
+
+@@ -556,7 +559,7 @@ static int acp_hw_fini(struct amdgpu_ip_
+ kfree(adev->acp.acp_genpd);
+ kfree(adev->acp.acp_cell);
+
+- return 0;
++ return ret;
+ }
+
+ static int acp_suspend(struct amdgpu_ip_block *ip_block)
--- /dev/null
+From d06c4173a7c38c7a39e98859f839ce714c7af2c9 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:19:52 -0400
+Subject: drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit d06c4173a7c38c7a39e98859f839ce714c7af2c9 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -4022,7 +4022,7 @@ static void gfx_v10_0_wait_reg_mem(struc
+ WAIT_REG_MEM_ENGINE(eng_sel)));
+
+ if (mem_space)
+- BUG_ON(addr0 & 0x3); /* Dword align */
++ WARN_ON(addr0 & 0x3); /* Dword align */
+ amdgpu_ring_write(ring, addr0);
+ amdgpu_ring_write(ring, addr1);
+ amdgpu_ring_write(ring, ref);
+@@ -8674,7 +8674,7 @@ static void gfx_v10_0_ring_emit_ib_gfx(s
+ }
+
+ amdgpu_ring_write(ring, header);
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -8709,7 +8709,7 @@ static void gfx_v10_0_ring_emit_ib_compu
+ }
+
+ amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -8742,9 +8742,9 @@ static void gfx_v10_0_ring_emit_fence(st
+ * aligned if only send 32bit data low (discard data high)
+ */
+ if (write64bit)
+- BUG_ON(addr & 0x7);
++ WARN_ON(addr & 0x7);
+ else
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -8792,9 +8792,6 @@ static void gfx_v10_0_ring_emit_fence_ki
+ {
+ struct amdgpu_device *adev = ring->adev;
+
+- /* we only allocate 32bit for each seq wb address */
+- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
+-
+ /* write fence seq to the "addr" */
+ amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+ amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
--- /dev/null
+From 0eebcab1ea2a77f086a04108f386f82ee3496022 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:20:55 -0400
+Subject: drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0eebcab1ea2a77f086a04108f386f82ee3496022 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+@@ -537,7 +537,7 @@ static void gfx_v11_0_wait_reg_mem(struc
+ WAIT_REG_MEM_ENGINE(eng_sel)));
+
+ if (mem_space)
+- BUG_ON(addr0 & 0x3); /* Dword align */
++ WARN_ON(addr0 & 0x3); /* Dword align */
+ amdgpu_ring_write(ring, addr0);
+ amdgpu_ring_write(ring, addr1);
+ amdgpu_ring_write(ring, ref);
+@@ -5901,7 +5901,7 @@ static void gfx_v11_0_ring_emit_ib_gfx(s
+ }
+
+ amdgpu_ring_write(ring, header);
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -5936,7 +5936,7 @@ static void gfx_v11_0_ring_emit_ib_compu
+ }
+
+ amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -5969,9 +5969,9 @@ static void gfx_v11_0_ring_emit_fence(st
+ * aligned if only send 32bit data low (discard data high)
+ */
+ if (write64bit)
+- BUG_ON(addr & 0x7);
++ WARN_ON(addr & 0x7);
+ else
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -6025,9 +6025,6 @@ static void gfx_v11_0_ring_emit_fence_ki
+ {
+ struct amdgpu_device *adev = ring->adev;
+
+- /* we only allocate 32bit for each seq wb address */
+- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
+-
+ /* write fence seq to the "addr" */
+ amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+ amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
--- /dev/null
+From cd3b3efa1ced05528d9128755338baa62a6b562d Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:21:58 -0400
+Subject: drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit cd3b3efa1ced05528d9128755338baa62a6b562d upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit f952076f76d62f783e8ba4995a7c400d39354ccf)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c
+@@ -439,7 +439,7 @@ static void gfx_v12_0_wait_reg_mem(struc
+ WAIT_REG_MEM_ENGINE(eng_sel)));
+
+ if (mem_space)
+- BUG_ON(addr0 & 0x3); /* Dword align */
++ WARN_ON(addr0 & 0x3); /* Dword align */
+ amdgpu_ring_write(ring, addr0);
+ amdgpu_ring_write(ring, addr1);
+ amdgpu_ring_write(ring, ref);
+@@ -4424,7 +4424,7 @@ static void gfx_v12_0_ring_emit_ib_gfx(s
+ control |= ib->length_dw | (vmid << 24);
+
+ amdgpu_ring_write(ring, header);
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -4443,7 +4443,7 @@ static void gfx_v12_0_ring_emit_ib_compu
+ u32 control = INDIRECT_BUFFER_VALID | ib->length_dw | (vmid << 24);
+
+ amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -4474,9 +4474,9 @@ static void gfx_v12_0_ring_emit_fence(st
+ * aligned if only send 32bit data low (discard data high)
+ */
+ if (write64bit)
+- BUG_ON(addr & 0x7);
++ WARN_ON(addr & 0x7);
+ else
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -4524,9 +4524,6 @@ static void gfx_v12_0_ring_emit_fence_ki
+ {
+ struct amdgpu_device *adev = ring->adev;
+
+- /* we only allocate 32bit for each seq wb address */
+- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
+-
+ /* write fence seq to the "addr" */
+ amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+ amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
--- /dev/null
+From 84a1a8a952ab4b8c23c5dd1f2eea4049cb4914f5 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:17:59 -0400
+Subject: drm/amdgpu/gfx8: drop unecessary BUG_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 84a1a8a952ab4b8c23c5dd1f2eea4049cb4914f5 upstream.
+
+There's no need to crash the kernel for this case.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -6226,9 +6226,6 @@ static void gfx_v8_0_ring_emit_fence_com
+ static void gfx_v8_0_ring_emit_fence_kiq(struct amdgpu_ring *ring, u64 addr,
+ u64 seq, unsigned int flags)
+ {
+- /* we only allocate 32bit for each seq wb address */
+- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
+-
+ /* write fence seq to the "addr" */
+ amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+ amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
--- /dev/null
+From 6302be10b521f5106ce01eb5a724b9e7945a5061 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:14:59 -0400
+Subject: drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 6302be10b521f5106ce01eb5a724b9e7945a5061 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -1183,7 +1183,7 @@ static void gfx_v9_0_wait_reg_mem(struct
+ WAIT_REG_MEM_ENGINE(eng_sel)));
+
+ if (mem_space)
+- BUG_ON(addr0 & 0x3); /* Dword align */
++ WARN_ON(addr0 & 0x3); /* Dword align */
+ amdgpu_ring_write(ring, addr0);
+ amdgpu_ring_write(ring, addr1);
+ amdgpu_ring_write(ring, ref);
+@@ -5473,7 +5473,7 @@ static void gfx_v9_0_ring_emit_ib_gfx(st
+ }
+
+ amdgpu_ring_write(ring, header);
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -5569,7 +5569,7 @@ static void gfx_v9_0_ring_emit_ib_comput
+ }
+
+ amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -5610,9 +5610,9 @@ static void gfx_v9_0_ring_emit_fence(str
+ * aligned if only send 32bit data low (discard data high)
+ */
+ if (write64bit)
+- BUG_ON(addr & 0x7);
++ WARN_ON(addr & 0x7);
+ else
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
--- /dev/null
+From 00f4050f7c367d7bdce347ca279ce467c434cf15 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:42:35 -0400
+Subject: drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 00f4050f7c367d7bdce347ca279ce467c434cf15 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 5676593d08998d7a6d9e2d51d6b54b3820e3755c)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c
+@@ -405,7 +405,7 @@ static void gfx_v9_4_3_wait_reg_mem(stru
+ WAIT_REG_MEM_ENGINE(eng_sel)));
+
+ if (mem_space)
+- BUG_ON(addr0 & 0x3); /* Dword align */
++ WARN_ON(addr0 & 0x3); /* Dword align */
+ amdgpu_ring_write(ring, addr0);
+ amdgpu_ring_write(ring, addr1);
+ amdgpu_ring_write(ring, ref);
+@@ -2871,7 +2871,7 @@ static void gfx_v9_4_3_ring_emit_ib_comp
+ }
+
+ amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2));
+- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */
++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */
+ amdgpu_ring_write(ring,
+ #ifdef __BIG_ENDIAN
+ (2 << 0) |
+@@ -2905,9 +2905,9 @@ static void gfx_v9_4_3_ring_emit_fence(s
+ * aligned if only send 32bit data low (discard data high)
+ */
+ if (write64bit)
+- BUG_ON(addr & 0x7);
++ WARN_ON(addr & 0x7);
+ else
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -2967,9 +2967,6 @@ static void gfx_v9_4_3_ring_emit_fence_k
+ {
+ struct amdgpu_device *adev = ring->adev;
+
+- /* we only allocate 32bit for each seq wb address */
+- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
+-
+ /* write fence seq to the "addr" */
+ amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
+ amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
--- /dev/null
+From 28c9b3c5dc35cc790d11e26ca3fc6e068be63998 Mon Sep 17 00:00:00 2001
+From: Ce Sun <cesun102@amd.com>
+Date: Mon, 22 Jun 2026 22:58:16 +0800
+Subject: drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
+
+From: Ce Sun <cesun102@amd.com>
+
+commit 28c9b3c5dc35cc790d11e26ca3fc6e068be63998 upstream.
+
+Call pm_genpd_remove() to unregister from global list prior to releasing
+acp_genpd memory, and clear the pointer after free.
+
+Signed-off-by: Ce Sun <cesun102@amd.com>
+Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit cd8650d7a91ee8b768e202354672553faa5cc1f2)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+@@ -556,7 +556,9 @@ out:
+
+ mfd_remove_devices(adev->acp.parent);
+ kfree(adev->acp.acp_res);
++ pm_genpd_remove(&adev->acp.acp_genpd->gpd);
+ kfree(adev->acp.acp_genpd);
++ adev->acp.acp_genpd = NULL;
+ kfree(adev->acp.acp_cell);
+
+ return ret;
--- /dev/null
+From c44af3810fc8b3adf6910a332038aa566560c8fa Mon Sep 17 00:00:00 2001
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+Date: Fri, 26 Jun 2026 10:39:26 -0400
+Subject: drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
+
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+
+commit c44af3810fc8b3adf6910a332038aa566560c8fa upstream.
+
+jpeg_v4_0_3_is_idle() initializes ret to false and then accumulates ring
+idle status using &=. Since false & condition always remains false, the
+function can never report the JPEG block as idle.
+
+Initialize ret to true so the function returns true only when all JPEG
+rings report RB_JOB_DONE.
+
+Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit e9df8e9d04e0593d17ddb069f3b7958991cd18c9)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
+@@ -1010,7 +1010,7 @@ void jpeg_v4_0_3_dec_ring_nop(struct amd
+ static bool jpeg_v4_0_3_is_idle(struct amdgpu_ip_block *ip_block)
+ {
+ struct amdgpu_device *adev = ip_block->adev;
+- bool ret = false;
++ bool ret = true;
+ int i, j;
+
+ for (i = 0; i < adev->jpeg.num_jpeg_inst; ++i) {
--- /dev/null
+From efcedeececcf995fcf717b21e39aa7c446fa3bf7 Mon Sep 17 00:00:00 2001
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+Date: Wed, 24 Jun 2026 09:50:01 -0400
+Subject: drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
+
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+
+commit efcedeececcf995fcf717b21e39aa7c446fa3bf7 upstream.
+
+jpeg_v5_0_1_is_idle() initializes ret to false and then accumulates ring
+idle status using &=. Since false & condition always remains false, the
+function can never report the JPEG block as idle.
+
+Initialize ret to true so the function returns true only when all JPEG
+rings report RB_JOB_DONE.
+
+Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
+Reviewed-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 680adf5faeeabb4585f7aeb53681719e2d6c2f41)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c
+@@ -657,7 +657,7 @@ static void jpeg_v5_0_1_dec_ring_set_wpt
+ static bool jpeg_v5_0_1_is_idle(struct amdgpu_ip_block *ip_block)
+ {
+ struct amdgpu_device *adev = ip_block->adev;
+- bool ret = false;
++ bool ret = true;
+ int i, j;
+
+ for (i = 0; i < adev->jpeg.num_jpeg_inst; ++i) {
--- /dev/null
+From 40cdbe9fa424cc6264a7aed93a04bd7d69109d9e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:44:11 -0400
+Subject: drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 40cdbe9fa424cc6264a7aed93a04bd7d69109d9e upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit fa4f86a148271e325e95287630a3a15a9cd35fdc)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c
+@@ -458,7 +458,7 @@ static void sdma_v4_4_2_ring_emit_fence(
+ /* write the fence */
+ amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE));
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -468,7 +468,7 @@ static void sdma_v4_4_2_ring_emit_fence(
+ addr += 4;
+ amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE));
+ /* zero in first two bits */
+- BUG_ON(addr & 0x3);
++ WARN_ON(addr & 0x3);
+ amdgpu_ring_write(ring, lower_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(addr));
+ amdgpu_ring_write(ring, upper_32_bits(seq));
--- /dev/null
+From aff079bdce65f6d085e4b0091fdf87fffa95b0d9 Mon Sep 17 00:00:00 2001
+From: Jakob Linke <jakob@linke.cx>
+Date: Wed, 17 Jun 2026 08:24:15 +0200
+Subject: drm/amdgpu/soc24: reset dGPU if suspend got aborted
+
+From: Jakob Linke <jakob@linke.cx>
+
+commit aff079bdce65f6d085e4b0091fdf87fffa95b0d9 upstream.
+
+For SOC24 ASICs (RDNA4 / Navi 4x dGPUs) re-enabling PM features fails if an
+S3 suspend got aborted, the same issue already handled for SOC21 and SOC15:
+
+ commit df3c7dc5c58b ("drm/amdgpu: Reset dGPU if suspend got aborted")
+ commit 38e8ca3e4b6d ("amdgpu/soc15: enable asic reset for dGPU in case of suspend abort")
+
+The aborted resume fails with:
+
+ amdgpu: SMU: No response msg_reg: 6 resp_reg: 0
+ amdgpu: Failed to enable requested dpm features!
+ amdgpu: resume of IP block <smu> failed -62
+
+Apply the same workaround for soc24: detect the aborted-suspend state at
+resume via the sign-of-life register and reset the device before re-init.
+
+This is a workaround till a proper solution is finalized.
+
+Fixes: 98b912c50e44 ("drm/amdgpu: Add soc24 common ip block (v2)")
+Signed-off-by: Jakob Linke <jakob@linke.cx>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit fed5bdbfe1d4a19a26c70f7fc58017dc88be1c18)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc24.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/soc24.c
++++ b/drivers/gpu/drm/amd/amdgpu/soc24.c
+@@ -526,8 +526,36 @@ static int soc24_common_suspend(struct a
+ return soc24_common_hw_fini(ip_block);
+ }
+
++static bool soc24_need_reset_on_resume(struct amdgpu_device *adev)
++{
++ u32 sol_reg1, sol_reg2;
++
++ /* Will reset for the following suspend abort cases.
++ * 1) Only reset dGPU side.
++ * 2) S3 suspend got aborted and TOS is active.
++ * As for dGPU suspend abort cases the SOL value
++ * will be kept as zero at this resume point.
++ */
++ if (!(adev->flags & AMD_IS_APU) && adev->in_s3) {
++ sol_reg1 = RREG32_SOC15(MP0, 0, regMPASP_SMN_C2PMSG_81);
++ msleep(100);
++ sol_reg2 = RREG32_SOC15(MP0, 0, regMPASP_SMN_C2PMSG_81);
++
++ return (sol_reg1 != sol_reg2);
++ }
++
++ return false;
++}
++
+ static int soc24_common_resume(struct amdgpu_ip_block *ip_block)
+ {
++ struct amdgpu_device *adev = ip_block->adev;
++
++ if (soc24_need_reset_on_resume(adev)) {
++ dev_info(adev->dev, "S3 suspend aborted, resetting...");
++ soc24_asic_reset(adev);
++ }
++
+ return soc24_common_hw_init(ip_block);
+ }
+
--- /dev/null
+From 186bfdc4e26d019b2e7570cb121964a1d89b2e5b Mon Sep 17 00:00:00 2001
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+Date: Mon, 25 May 2026 11:34:27 -0400
+Subject: drm/amdgpu/vce: fix integer overflow in image size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+
+commit 186bfdc4e26d019b2e7570cb121964a1d89b2e5b upstream.
+
+Fix a security vulnerability where malicious VCE command streams
+with oversized dimensions (e.g. 65536×65536) cause 32-bit integer
+overflow, wrapping the calculated buffer size to 0. This bypasses
+validation and allows GPU firmware to perform out-of-bound memory
+access.
+
+The fix uses 64-bit arithmetic to detect overflow and rejects
+invalid dimensions before they reach the hardware.
+
+V2: remove redundant check
+V3: modify max height value
+V4: remove size64
+
+Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+@@ -853,9 +853,20 @@ int amdgpu_vce_ring_parse_cs(struct amdg
+ goto out;
+ }
+
+- *size = amdgpu_ib_get_value(ib, idx + 8) *
+- amdgpu_ib_get_value(ib, idx + 10) *
+- 8 * 3 / 2;
++ uint32_t width, height;
++ width = amdgpu_ib_get_value(ib, idx + 8);
++ height = amdgpu_ib_get_value(ib, idx + 10);
++
++ if (width == 0 || height == 0 ||
++ width > 4096 || height > 2304) {
++ DRM_ERROR("invalid VCE image size: %ux%u\n",
++ width, height);
++ r = -EINVAL;
++ goto out;
++ }
++
++ *size = width * height * 8 * 3 / 2;
++
+ break;
+
+ case 0x04000001: /* config extension */
--- /dev/null
+From 3b4082fabc67c9780b06eb959e59dd92fa79c0f0 Mon Sep 17 00:00:00 2001
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+Date: Thu, 21 May 2026 09:59:37 -0400
+Subject: drm/amdgpu/vcn4: avoid rereading IB param length
+
+From: Boyuan Zhang <boyuan.zhang@amd.com>
+
+commit 3b4082fabc67c9780b06eb959e59dd92fa79c0f0 upstream.
+
+Reuse the parameter length returned by
+vcn_v4_0_enc_find_ib_param() instead of rereading it from
+the IB.
+
+This avoids a potential TOCTOU issue if the IB contents
+change between reads.
+
+Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com>
+Reviewed-by: David Rosca <david.rosca@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+@@ -1926,14 +1926,17 @@ out:
+ #define RENCODE_IB_PARAM_SESSION_INIT 0x00000003
+
+ /* return the offset in ib if id is found, -1 otherwise */
+-static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int start)
++static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int start, uint32_t *length)
+ {
+ int i;
+ uint32_t len;
+
+ for (i = start; (len = amdgpu_ib_get_value(ib, i)) >= 8; i += len / 4) {
+- if (amdgpu_ib_get_value(ib, i + 1) == id)
++ if (amdgpu_ib_get_value(ib, i + 1) == id) {
++ if (length)
++ *length = len;
+ return i;
++ }
+ }
+ return -1;
+ }
+@@ -1943,14 +1946,14 @@ static int vcn_v4_0_ring_patch_cs_in_pla
+ struct amdgpu_ib *ib)
+ {
+ struct amdgpu_ring *ring = amdgpu_job_ring(job);
+- uint32_t val;
++ uint32_t val, len;
+ int idx = 0, sidx;
+
+ /* The first instance can decode anything */
+ if (!ring->me)
+ return 0;
+
+- while ((idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, idx)) >= 0) {
++ while ((idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, idx, &len)) >= 0) {
+ val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */
+ if (val == RADEON_VCN_ENGINE_TYPE_DECODE) {
+ uint32_t valid_buf_flag = amdgpu_ib_get_value(ib, idx + 6);
+@@ -1963,12 +1966,12 @@ static int vcn_v4_0_ring_patch_cs_in_pla
+ amdgpu_ib_get_value(ib, idx + 8);
+ return vcn_v4_0_dec_msg(p, job, msg_buffer_addr);
+ } else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) {
+- sidx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, idx);
++ sidx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, idx, NULL);
+ if (sidx >= 0 &&
+ amdgpu_ib_get_value(ib, sidx + 2) == RENCODE_ENCODE_STANDARD_AV1)
+ return vcn_v4_0_limit_sched(p, job);
+ }
+- idx += amdgpu_ib_get_value(ib, idx) / 4;
++ idx += len / 4;
+ }
+ return 0;
+ }
--- /dev/null
+From 613059875958e7b217b250ed14c3b189f9488421 Mon Sep 17 00:00:00 2001
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Mon, 22 Jun 2026 17:03:58 +0300
+Subject: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+commit 613059875958e7b217b250ed14c3b189f9488421 upstream.
+
+A hotplug or link-loss event can tear down the MST topology
+(setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently
+with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check
+is already performed under mgr->lock, the condition is not a programming
+error but a valid race -- the topology was valid when the caller decided
+to call this function, but was torn down before the lock was acquired.
+
+Replace the drm_WARN_ON() with a graceful early return. This eliminates
+spurious kernel warnings and the resulting compositor crashes observed
+when connecting/disconnecting DP MST monitors, while keeping the correct
+behavior of doing nothing when MST is not active. A drm_dbg_mst() trace
+is added so the skipped probe remains observable under MST debug logging.
+
+The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst()
+already catches the case where the topology is initialized twice, so no
+diagnostic coverage is lost.
+
+Fixes: dbaeef363ea5 ("drm/dp_mst: Add a helper to queue a topology probe")
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: Lyude Paul <lyude@redhat.com>
+Cc: stable@vger.kernel.org
+Cc: intel-gfx@lists.freedesktop.org
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Jonas Emilsson <jonas.emilsson@gmail.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/all/20260503034533.1023686-1-jonas.emilsson@gmail.com
+Acked-by: Imre Deak <imre.deak@intel.com>
+Link: https://patch.msgid.link/20260622140532.526722-1-luciano.coelho@intel.com
+Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -3740,8 +3740,10 @@ void drm_dp_mst_topology_queue_probe(str
+ {
+ mutex_lock(&mgr->lock);
+
+- if (drm_WARN_ON(mgr->dev, !mgr->mst_state || !mgr->mst_primary))
++ if (!mgr->mst_state || !mgr->mst_primary) {
++ drm_dbg_kms(mgr->dev, "queue_probe skipped: topology torn down\n");
+ goto out_unlock;
++ }
+
+ drm_dp_mst_topology_mgr_invalidate_mstb(mgr->mst_primary);
+ drm_dp_mst_queue_probe_work(mgr);
vsock-virtio-collapse-receive-queue-under-memory-pressure.patch
vxlan-mdb-fix-source-list-corruption-on-a-failed-replace.patch
watchdog-s32g_wdt-remove-incorrect-options-in-watchdog_info-struct.patch
+drm-amd-pm-fix-amdgpu_pm_info-power-display-units.patch
+drm-amd-pm-make-pp_features-read-only-when-scpm-is-enabled.patch
+drm-amdgpu-gfx10-replace-bug_on-with-warn_on.patch
+drm-amdgpu-gfx11-replace-bug_on-with-warn_on.patch
+drm-amdgpu-gfx12-replace-bug_on-with-warn_on.patch
+drm-amdgpu-gfx8-drop-unecessary-bug_on.patch
+drm-amdgpu-gfx9.4.3-replace-bug_on-with-warn_on.patch
+drm-amdgpu-gfx9-replace-bug_on-with-warn_on.patch
+drm-amdgpu-jpeg-fix-jpeg_v4_0_3_is_idle-detection.patch
+drm-amdgpu-jpeg-fix-jpeg_v5_0_1_is_idle-detection.patch
+drm-amdgpu-sdma4.4.2-replace-bug_on-with-warn_on.patch
+drm-amdgpu-soc24-reset-dgpu-if-suspend-got-aborted.patch
+drm-amdgpu-vce-fix-integer-overflow-in-image-size.patch
+drm-amdgpu-vcn4-avoid-rereading-ib-param-length.patch
+drm-dp_mst-handle-torn-down-topology-gracefully-in-drm_dp_mst_topology_queue_probe.patch
+drm-amdgpu-fix-division-by-zero-with-invalid-uvd-dimensions.patch
+drm-amdgpu-fix-resource-leak-on-acp-reset-timeout.patch
+drm-amdgpu-invoke-pm_genpd_remove-before-freeing-genpd.patch
+drm-amdgpu-fix-aperture-mapping-leak.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
