From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 16:31:41 +0000 (+0200) Subject: 7.1-stable patches X-Git-Tag: v5.10.262~14 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=22d69e5cbd7ce925abb24953444e1df5635d3ba3;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: drm-amd-pm-fix-amdgpu_pm_info-power-display-units.patch drm-amd-pm-make-pp_features-read-only-when-scpm-is-enabled.patch drm-amdgpu-fix-aperture-mapping-leak.patch drm-amdgpu-fix-division-by-zero-with-invalid-uvd-dimensions.patch drm-amdgpu-fix-kernel-panic-during-driver-load-failure.patch drm-amdgpu-fix-resource-leak-on-acp-reset-timeout.patch drm-amdgpu-gfx10-replace-bug_on-with-warn_on.patch drm-amdgpu-gfx11-fix-eop-interrupt-routing-for-kq-and-userq.patch drm-amdgpu-gfx12-fix-eop-interrupt-routing-for-kq-and-userq.patch drm-amdgpu-gfx12-replace-bug_on-with-warn_on.patch drm-amdgpu-gfx12.1-replace-bug_on-with-warn_on.patch drm-amdgpu-gfx8-drop-unecessary-bug_on.patch drm-amdgpu-gfx9-replace-bug_on-with-warn_on.patch drm-amdgpu-gfx9.4.3-replace-bug_on-with-warn_on.patch drm-amdgpu-invoke-pm_genpd_remove-before-freeing-genpd.patch drm-amdgpu-jpeg-fix-jpeg_v4_0_3_is_idle-detection.patch drm-amdgpu-jpeg-fix-jpeg_v5_0_1_is_idle-detection.patch drm-amdgpu-mes11-set-doorbell-offset-for-suspending-userq.patch drm-amdgpu-reject-mapping-a-reserved-doorbell-to-a-new-queue.patch drm-amdgpu-sdma4.4.2-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma7.1-replace-bug_on-with-warn_on.patch drm-amdgpu-vce-fix-integer-overflow-in-image-size.patch drm-amdgpu-vcn4-avoid-rereading-ib-param-length.patch drm-dp_mst-handle-torn-down-topology-gracefully-in-drm_dp_mst_topology_queue_probe.patch --- diff --git a/queue-7.1/drm-amd-pm-fix-amdgpu_pm_info-power-display-units.patch b/queue-7.1/drm-amd-pm-fix-amdgpu_pm_info-power-display-units.patch new file mode 100644 index 0000000000..a806a3cfd9 --- /dev/null +++ b/queue-7.1/drm-amd-pm-fix-amdgpu_pm_info-power-display-units.patch @@ -0,0 +1,104 @@ +From 238baca26a6279e688d1a156bd031390b82eb578 Mon Sep 17 00:00:00 2001 +From: Yang Wang +Date: Thu, 18 Jun 2026 12:54:14 +0800 +Subject: drm/amd/pm: fix amdgpu_pm_info power display units + +From: Yang Wang + +commit 238baca26a6279e688d1a156bd031390b82eb578 upstream. + +amdgpu_pm_info displayed power sensor readings with the wrong fractional unit. +It treated the low byte of the raw sensor value as the decimal part of watts, +while that field represents milliwatts in the decoded value. As a result, +debugfs could report misleading SoC power when the remainder was not already +a two-digit centiwatt value. + +Example with query = 0x00000354: + + raw field value + --------------------- + query >> 8 3 W + query & 0xff 84 mW + decoded power 3084 mW + + output value + --------------------- + before 3.84 W + after 3.08 W + +Fixes: f0b8f65b4825 ("drm/amd/amdgpu: fix the GPU power print error in pm info") +Signed-off-by: Yang Wang +Reviewed-by: Asad Kamal +Signed-off-by: Alex Deucher +(cherry picked from commit 01992b121fb652c753d37e0c1427a2d1a557d2b1) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/amdgpu_pm.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c +@@ -41,6 +41,8 @@ + + #define DEVICE_ATTR_IS(_name) (attr_id == device_attr_id__##_name) + ++#define power_2_mwatt(power) (((power) >> 8) * 1000 + ((power) & 0xff)) ++ + struct od_attribute { + struct kobj_attribute attribute; + struct list_head entry; +@@ -3333,7 +3335,6 @@ static int amdgpu_hwmon_get_power(struct + enum amd_pp_sensors sensor) + { + struct amdgpu_device *adev = dev_get_drvdata(dev); +- unsigned int uw; + u32 query = 0; + int r; + +@@ -3342,9 +3343,7 @@ static int amdgpu_hwmon_get_power(struct + return r; + + /* convert to microwatts */ +- uw = (query >> 8) * 1000000 + (query & 0xff) * 1000; +- +- return uw; ++ return power_2_mwatt(query) * 1000; + } + + static ssize_t amdgpu_hwmon_show_power_avg(struct device *dev, +@@ -4882,7 +4881,7 @@ static int amdgpu_debugfs_pm_info_pp(str + { + uint32_t mp1_ver = amdgpu_ip_version(adev, MP1_HWIP, 0); + uint32_t gc_ver = amdgpu_ip_version(adev, GC_HWIP, 0); +- uint32_t value; ++ uint32_t value, mwatt, centiwatt; + uint64_t value64 = 0; + uint32_t query = 0; + int size; +@@ -4907,17 +4906,21 @@ static int amdgpu_debugfs_pm_info_pp(str + seq_printf(m, "\t%u mV (VDDNB)\n", value); + size = sizeof(uint32_t); + if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GPU_AVG_POWER, (void *)&query, &size)) { ++ mwatt = power_2_mwatt(query); ++ centiwatt = DIV_ROUND_CLOSEST(mwatt, 10); + if (adev->flags & AMD_IS_APU) +- seq_printf(m, "\t%u.%02u W (average SoC including CPU)\n", query >> 8, query & 0xff); ++ seq_printf(m, "\t%u.%02u W (average SoC including CPU)\n", centiwatt / 100, centiwatt % 100); + else +- seq_printf(m, "\t%u.%02u W (average SoC)\n", query >> 8, query & 0xff); ++ seq_printf(m, "\t%u.%02u W (average SoC)\n", centiwatt / 100, centiwatt % 100); + } + size = sizeof(uint32_t); + if (!amdgpu_dpm_read_sensor(adev, AMDGPU_PP_SENSOR_GPU_INPUT_POWER, (void *)&query, &size)) { ++ mwatt = power_2_mwatt(query); ++ centiwatt = DIV_ROUND_CLOSEST(mwatt, 10); + if (adev->flags & AMD_IS_APU) +- seq_printf(m, "\t%u.%02u W (current SoC including CPU)\n", query >> 8, query & 0xff); ++ seq_printf(m, "\t%u.%02u W (current SoC including CPU)\n", centiwatt / 100, centiwatt % 100); + else +- seq_printf(m, "\t%u.%02u W (current SoC)\n", query >> 8, query & 0xff); ++ seq_printf(m, "\t%u.%02u W (current SoC)\n", centiwatt / 100, centiwatt % 100); + } + size = sizeof(value); + seq_printf(m, "\n"); diff --git a/queue-7.1/drm-amd-pm-make-pp_features-read-only-when-scpm-is-enabled.patch b/queue-7.1/drm-amd-pm-make-pp_features-read-only-when-scpm-is-enabled.patch new file mode 100644 index 0000000000..dd848cd6b0 --- /dev/null +++ b/queue-7.1/drm-amd-pm-make-pp_features-read-only-when-scpm-is-enabled.patch @@ -0,0 +1,38 @@ +From 53c78ab388bfc1a4d72e756815d0db0a842c812e Mon Sep 17 00:00:00 2001 +From: Yang Wang +Date: Fri, 12 Jun 2026 10:55:09 +0800 +Subject: drm/amd/pm: make pp_features read-only when scpm is enabled + +From: Yang Wang + +commit 53c78ab388bfc1a4d72e756815d0db0a842c812e upstream. + +SCPM owns power feature control when enabled. + +Make pp_features read-only during sysfs setup by clearing its write bits +and store callback. + +Signed-off-by: Yang Wang +Reviewed-by: Asad Kamal +Signed-off-by: Alex Deucher +(cherry picked from commit 6a5786e191fdce36c5db170e5209cf609e8f0087) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/amdgpu_pm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c +@@ -2682,6 +2682,11 @@ static int default_attr_update(struct am + gc_ver != IP_VERSION(9, 4, 3)) || + gc_ver < IP_VERSION(9, 0, 0)) + *states = ATTR_STATE_UNSUPPORTED; ++ ++ if (adev->scpm_enabled) { ++ dev_attr->attr.mode &= ~S_IWUGO; ++ dev_attr->store = NULL; ++ } + } else if (DEVICE_ATTR_IS(gpu_metrics)) { + if (gc_ver < IP_VERSION(9, 1, 0)) + *states = ATTR_STATE_UNSUPPORTED; diff --git a/queue-7.1/drm-amdgpu-fix-aperture-mapping-leak.patch b/queue-7.1/drm-amdgpu-fix-aperture-mapping-leak.patch new file mode 100644 index 0000000000..5d0d8b3f34 --- /dev/null +++ b/queue-7.1/drm-amdgpu-fix-aperture-mapping-leak.patch @@ -0,0 +1,125 @@ +From ea772a440d56b285f4d491affac50ecd41f6b402 Mon Sep 17 00:00:00 2001 +From: Asad Kamal +Date: Sun, 14 Jun 2026 12:50:28 +0800 +Subject: drm/amdgpu: fix aperture mapping leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Asad Kamal + +commit ea772a440d56b285f4d491affac50ecd41f6b402 upstream. + +amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver +fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to +always return false, so iounmap(aper_base_kaddr) never runs on normal +driver unload, leaving an orphaned entry in the x86 PAT interval tree. + +On connected_to_cpu hardware, the aperture is mapped write-back (WB) via +ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC) +over the same range. The WC vs WB conflict causes: + + ioremap error for 0x..., requested 0x1, got 0x0 + amdgpu: discovery failed: -2 + +Fix by switching to devres-managed mappings so cleanup is guaranteed +regardless of drm_dev_enter() state: + +- connected_to_cpu path: devm_memremap(MEMREMAP_WB). For + IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut, + returning __va(offset) from the existing kernel direct map. No new + ioremap VA or PAT entry is created, so there is nothing to orphan. + +- dGPU path: devm_ioremap_wc() registers iounmap() as a devres action, + guaranteeing cleanup at device_del() time. + +Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio() +since the mapping is now devres-owned. + +v2: Remove redundant x86_64 guard (Lijo) + +Fixes: 9d0af8b4def0 ("drm/amdgpu: pre-map device buffer as cached for A+A config") +Signed-off-by: Asad Kamal +Reviewed-by: Christian König +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +(cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 - + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 36 ++++++++++++----------------- + 2 files changed, 16 insertions(+), 22 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4169,8 +4169,6 @@ static void amdgpu_device_unmap_mmio(str + + iounmap(adev->rmmio); + adev->rmmio = NULL; +- if (adev->mman.aper_base_kaddr) +- iounmap(adev->mman.aper_base_kaddr); + adev->mman.aper_base_kaddr = NULL; + + /* Memory manager related */ +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -2121,18 +2121,23 @@ int amdgpu_ttm_init(struct amdgpu_device + /* Change the size here instead of the init above so only lpfn is affected */ + amdgpu_ttm_set_buffer_funcs_status(adev, false); + #ifdef CONFIG_64BIT +-#ifdef CONFIG_X86 +- if (adev->gmc.xgmi.connected_to_cpu) +- adev->mman.aper_base_kaddr = ioremap_cache(adev->gmc.aper_base, +- adev->gmc.visible_vram_size); +- +- else if (adev->gmc.is_app_apu) ++ if (adev->gmc.xgmi.connected_to_cpu) { ++ void *kaddr = devm_memremap(adev->dev, adev->gmc.aper_base, ++ adev->gmc.visible_vram_size, ++ MEMREMAP_WB); ++ if (IS_ERR(kaddr)) ++ return PTR_ERR(kaddr); ++ adev->mman.aper_base_kaddr = (__force void __iomem *)kaddr; ++ } else if (adev->gmc.is_app_apu) { + DRM_DEBUG_DRIVER( + "No need to ioremap when real vram size is 0\n"); +- else +-#endif +- adev->mman.aper_base_kaddr = ioremap_wc(adev->gmc.aper_base, +- adev->gmc.visible_vram_size); ++ } else { ++ adev->mman.aper_base_kaddr = devm_ioremap_wc(adev->dev, ++ adev->gmc.aper_base, ++ adev->gmc.visible_vram_size); ++ if (!adev->mman.aper_base_kaddr) ++ return -ENOMEM; ++ } + #endif + + amdgpu_ttm_init_vram_resv_regions(adev); +@@ -2249,8 +2254,6 @@ int amdgpu_ttm_init(struct amdgpu_device + */ + void amdgpu_ttm_fini(struct amdgpu_device *adev) + { +- int idx; +- + if (!adev->mman.initialized) + return; + +@@ -2273,14 +2276,7 @@ void amdgpu_ttm_fini(struct amdgpu_devic + amdgpu_ttm_unmark_vram_reserved(adev, AMDGPU_RESV_FW_VRAM_USAGE); + amdgpu_ttm_unmark_vram_reserved(adev, AMDGPU_RESV_DRV_VRAM_USAGE); + +- if (drm_dev_enter(adev_to_drm(adev), &idx)) { +- +- if (adev->mman.aper_base_kaddr) +- iounmap(adev->mman.aper_base_kaddr); +- adev->mman.aper_base_kaddr = NULL; +- +- drm_dev_exit(idx); +- } ++ adev->mman.aper_base_kaddr = NULL; + + if (!adev->gmc.is_app_apu) + amdgpu_vram_mgr_fini(adev); diff --git a/queue-7.1/drm-amdgpu-fix-division-by-zero-with-invalid-uvd-dimensions.patch b/queue-7.1/drm-amdgpu-fix-division-by-zero-with-invalid-uvd-dimensions.patch new file mode 100644 index 0000000000..6146392785 --- /dev/null +++ b/queue-7.1/drm-amdgpu-fix-division-by-zero-with-invalid-uvd-dimensions.patch @@ -0,0 +1,48 @@ +From 0c01c811be47e6b146552dd59bfedbea8f09b8f4 Mon Sep 17 00:00:00 2001 +From: Boyuan Zhang +Date: Tue, 12 May 2026 10:29:36 -0400 +Subject: drm/amdgpu: fix division by zero with invalid uvd dimensions + +From: Boyuan Zhang + +commit 0c01c811be47e6b146552dd59bfedbea8f09b8f4 upstream. + +When width or height is less than 16, width_in_mb or height_in_mb +becomes 0, leading to fs_in_mb being 0. This causes a division by +zero when calculating num_dpb_buffer in H264 and H264 Perf decode +paths. + +Add validation to reject frames with width < 16 or height < 16 +before performing any calculations that depend on these values. + +V2: Format change - move up all vaiable definitions. +V3: Use warn_once to avoid spam. + +Signed-off-by: Boyuan Zhang +Reviewed-by: Leo Liu +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 3e41d26c70b0a459d041cc19482a226c4b7423cb) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -655,6 +655,14 @@ static int amdgpu_uvd_cs_msg_decode(stru + unsigned int image_size, tmp, min_dpb_size, num_dpb_buffer; + unsigned int min_ctx_size = ~0; + ++ /* Reject invalid dimensions to prevent division by zero */ ++ if (width < 16 || height < 16) { ++ dev_WARN_ONCE(adev->dev, 1, ++ "Invalid UVD decoding dimensions (%dx%d)!\n", ++ width, height); ++ return -EINVAL; ++ } ++ + image_size = width * height; + image_size += image_size / 2; + image_size = ALIGN(image_size, 1024); diff --git a/queue-7.1/drm-amdgpu-fix-kernel-panic-during-driver-load-failure.patch b/queue-7.1/drm-amdgpu-fix-kernel-panic-during-driver-load-failure.patch new file mode 100644 index 0000000000..d4593fcf32 --- /dev/null +++ b/queue-7.1/drm-amdgpu-fix-kernel-panic-during-driver-load-failure.patch @@ -0,0 +1,102 @@ +From a279bd143b3c184358b658e43a057e31ee8c4de5 Mon Sep 17 00:00:00 2001 +From: Harish Kasiviswanathan +Date: Fri, 26 Jun 2026 12:21:54 -0400 +Subject: drm/amdgpu: Fix kernel panic during driver load failure + +From: Harish Kasiviswanathan + +commit a279bd143b3c184358b658e43a057e31ee8c4de5 upstream. + +Avoid kernel panic if MES init fails during driver load. The KIQ ring is +falsely marked as ready as ASICs that use MES, KIQ is owned by MES. + +BUG: kernel NULL pointer dereference, address: 0000000000000000 +RIP: 0010:gfx_v12_1_wait_reg_mem+0x5a/0x1f0 [amdgpu] +Call Trace: + gfx_v12_1_ring_emit_reg_write_reg_wait+0x1f/0x30 [amdgpu] + amdgpu_gmc_fw_reg_write_reg_wait+0xb2/0x190 [amdgpu] + amdgpu_gmc_flush_gpu_tlb+0x1cc/0x230 [amdgpu] + amdgpu_gart_invalidate_tlb+0x81/0xa0 [amdgpu] + amdgpu_gart_unbind+0x72/0x90 [amdgpu] + amdgpu_ttm_backend_unbind+0xa4/0xb0 [amdgpu] + amdgpu_ttm_tt_unpopulate+0x13/0xd0 [amdgpu] + amdttm_tt_unpopulate+0x29/0x70 [amdttm] + ttm_bo_put+0x1eb/0x360 [amdttm] + amdgpu_bo_free_kernel+0xf9/0x1f0 [amdgpu] + amdgpu_ih_ring_fini+0x5a/0x90 [amdgpu] + amdgpu_irq_fini_hw+0x58/0x80 [amdgpu] + amdgpu_device_fini_hw+0x4e0/0x5b0 [amdgpu] + amdgpu_driver_load_kms+0x60/0xa0 [amdgpu] + amdgpu_pci_probe+0x28e/0x6d0 [amdgpu] + pci_device_probe+0x19f/0x220 + really_probe+0x1ed/0x340 + driver_probe_device+0x1e/0x80 + __driver_attach+0xd3/0x1a0 + bus_for_each_dev+0x68/0xa0 + bus_add_driver+0x19f/0x270 + driver_register+0x5d/0xf0 + do_one_initcall+0xac/0x200 + do_init_module+0x1ec/0x280 + __se_sys_finit_module+0x2de/0x310 + do_syscall_64+0x6a/0x250 + entry_SYSCALL_64_after_hwframe+0x4b/0x53 + +Signed-off-by: Harish Kasiviswanathan +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +(cherry picked from commit 4623b958dd6da0f4c3026afdf330626a09ecb0f0) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 13 +++++++++++-- + drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | 13 +++++++++++-- + 2 files changed, 22 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +@@ -3514,10 +3514,19 @@ static int gfx_v12_0_cp_resume(struct am + gfx_v12_0_cp_gfx_enable(adev, true); + } + +- if (adev->enable_mes_kiq && adev->mes.kiq_hw_init) ++ if (adev->enable_mes_kiq && adev->mes.kiq_hw_init) { + r = amdgpu_mes_kiq_hw_init(adev, 0); +- else ++ /* ++ * With MES, GFX KIQ ring is owned by the MES and is never ++ * initialized/used directly by the driver, so it must ++ * not be left flagged as ready. mes_v12_0_hw_init() clears ++ * but clear here if MES init fails ++ */ ++ if (r) ++ adev->gfx.kiq[0].ring.sched.ready = false; ++ } else { + r = gfx_v12_0_kiq_resume(adev); ++ } + if (r) + return r; + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c +@@ -2502,10 +2502,19 @@ static int gfx_v12_1_xcc_cp_resume(struc + + gfx_v12_1_xcc_cp_compute_enable(adev, true, xcc_id); + +- if (adev->enable_mes_kiq && adev->mes.kiq_hw_init) ++ if (adev->enable_mes_kiq && adev->mes.kiq_hw_init) { + r = amdgpu_mes_kiq_hw_init(adev, xcc_id); +- else ++ /* ++ * With MES, GFX KIQ ring is owned by the MES and is never ++ * initialized/used directly by the driver, so it must ++ * not be left flagged as ready. mes_v12_0_hw_init() clears ++ * but clear here if MES init fails ++ */ ++ if (r) ++ adev->gfx.kiq[xcc_id].ring.sched.ready = false; ++ } else { + r = gfx_v12_1_xcc_kiq_resume(adev, xcc_id); ++ } + if (r) + return r; + diff --git a/queue-7.1/drm-amdgpu-fix-resource-leak-on-acp-reset-timeout.patch b/queue-7.1/drm-amdgpu-fix-resource-leak-on-acp-reset-timeout.patch new file mode 100644 index 0000000000..ac7baaaba3 --- /dev/null +++ b/queue-7.1/drm-amdgpu-fix-resource-leak-on-acp-reset-timeout.patch @@ -0,0 +1,69 @@ +From 020da7c5aac5b86bad8a1571f6eda6b8cff9331d Mon Sep 17 00:00:00 2001 +From: Ce Sun +Date: Mon, 22 Jun 2026 23:05:09 +0800 +Subject: drm/amdgpu: fix resource leak on ACP reset timeout + +From: Ce Sun + +commit 020da7c5aac5b86bad8a1571f6eda6b8cff9331d upstream. + +When ACP soft reset poll times out, original code returns early without cleanup, +leaking MFD child devices, genpd links and all ACP heap allocations. + +Replace direct early return with goto out to force run all cleanup logic +regardless of reset success, preserve timeout error code for caller. + +Signed-off-by: Ce Sun +Reviewed-by: Tao Zhou +Signed-off-by: Alex Deucher +(cherry picked from commit 98073e4328d7a8d75d03696ab27f6de70ef1aeda) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c +@@ -509,6 +509,7 @@ static int acp_hw_fini(struct amdgpu_ip_ + u32 val = 0; + u32 count = 0; + struct amdgpu_device *adev = ip_block->adev; ++ int ret = 0; + + /* return early if no ACP */ + if (!adev->acp.acp_genpd) { +@@ -530,7 +531,8 @@ static int acp_hw_fini(struct amdgpu_ip_ + break; + if (--count == 0) { + dev_err(&adev->pdev->dev, "Failed to reset ACP\n"); +- return -ETIMEDOUT; ++ ret = -ETIMEDOUT; ++ goto out; + } + udelay(100); + } +@@ -547,11 +549,12 @@ static int acp_hw_fini(struct amdgpu_ip_ + break; + if (--count == 0) { + dev_err(&adev->pdev->dev, "Failed to reset ACP\n"); +- return -ETIMEDOUT; ++ ret = -ETIMEDOUT; ++ goto out; + } + udelay(100); + } +- ++out: + device_for_each_child(adev->acp.parent, NULL, + acp_genpd_remove_device); + +@@ -560,7 +563,7 @@ static int acp_hw_fini(struct amdgpu_ip_ + kfree(adev->acp.acp_genpd); + kfree(adev->acp.acp_cell); + +- return 0; ++ return ret; + } + + static int acp_suspend(struct amdgpu_ip_block *ip_block) diff --git a/queue-7.1/drm-amdgpu-gfx10-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-gfx10-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..5ca66a5bc2 --- /dev/null +++ b/queue-7.1/drm-amdgpu-gfx10-replace-bug_on-with-warn_on.patch @@ -0,0 +1,71 @@ +From d06c4173a7c38c7a39e98859f839ce714c7af2c9 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:19:52 -0400 +Subject: drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit d06c4173a7c38c7a39e98859f839ce714c7af2c9 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -4022,7 +4022,7 @@ static void gfx_v10_0_wait_reg_mem(struc + WAIT_REG_MEM_ENGINE(eng_sel))); + + if (mem_space) +- BUG_ON(addr0 & 0x3); /* Dword align */ ++ WARN_ON(addr0 & 0x3); /* Dword align */ + amdgpu_ring_write(ring, addr0); + amdgpu_ring_write(ring, addr1); + amdgpu_ring_write(ring, ref); +@@ -8664,7 +8664,7 @@ static void gfx_v10_0_ring_emit_ib_gfx(s + } + + amdgpu_ring_write(ring, header); +- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */ ++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */ + amdgpu_ring_write(ring, + #ifdef __BIG_ENDIAN + (2 << 0) | +@@ -8699,7 +8699,7 @@ static void gfx_v10_0_ring_emit_ib_compu + } + + amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2)); +- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */ ++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */ + amdgpu_ring_write(ring, + #ifdef __BIG_ENDIAN + (2 << 0) | +@@ -8732,9 +8732,9 @@ static void gfx_v10_0_ring_emit_fence(st + * aligned if only send 32bit data low (discard data high) + */ + if (write64bit) +- BUG_ON(addr & 0x7); ++ WARN_ON(addr & 0x7); + else +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -8782,9 +8782,6 @@ static void gfx_v10_0_ring_emit_fence_ki + { + struct amdgpu_device *adev = ring->adev; + +- /* we only allocate 32bit for each seq wb address */ +- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT); +- + /* write fence seq to the "addr" */ + amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3)); + amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) | diff --git a/queue-7.1/drm-amdgpu-gfx11-fix-eop-interrupt-routing-for-kq-and-userq.patch b/queue-7.1/drm-amdgpu-gfx11-fix-eop-interrupt-routing-for-kq-and-userq.patch new file mode 100644 index 0000000000..2be43eaecd --- /dev/null +++ b/queue-7.1/drm-amdgpu-gfx11-fix-eop-interrupt-routing-for-kq-and-userq.patch @@ -0,0 +1,98 @@ +From 0a3d35460320baf8744c7dcc3e287e07fbaf6d36 Mon Sep 17 00:00:00 2001 +From: Jesse Zhang +Date: Thu, 11 Jun 2026 10:14:32 +0800 +Subject: drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq + +From: Jesse Zhang + +commit 0a3d35460320baf8744c7dcc3e287e07fbaf6d36 upstream. + +Try KQ by ring_id first (KCQ and UQ never share a HW slot); fall back +to amdgpu_userq_process_fence_irq() on miss, since KQ EOPs were +misrouted into the userq fence path when enable_mes is true. + +Require a strict (me,pipe,queue) match in the gfx case, then userq gfx +EOPs fall through to amdgpu_userq_process_fence_irq(). + +Suggested-by: Alex Deucher +Signed-off-by: Jesse Zhang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 88e589cc811ba907209a426c426c469bcb4bb894) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 43 ++++++++++++++++++++++----------- + 1 file changed, 29 insertions(+), 14 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +@@ -6513,25 +6513,33 @@ static int gfx_v11_0_eop_irq(struct amdg + struct amdgpu_iv_entry *entry) + { + u32 doorbell_offset = entry->src_data[0]; +- u8 me_id, pipe_id, queue_id; +- struct amdgpu_ring *ring; +- int i; + + DRM_DEBUG("IH: CP EOP\n"); + +- if (adev->enable_mes && doorbell_offset) { +- amdgpu_userq_process_fence_irq(adev, doorbell_offset); +- } else { +- me_id = (entry->ring_id & 0x0c) >> 2; +- pipe_id = (entry->ring_id & 0x03) >> 0; +- queue_id = (entry->ring_id & 0x70) >> 4; ++ if (!adev->gfx.disable_kq) { ++ u8 me_id = (entry->ring_id & 0x0c) >> 2; ++ u8 pipe_id = (entry->ring_id & 0x03) >> 0; ++ u8 queue_id = (entry->ring_id & 0x70) >> 4; ++ struct amdgpu_ring *ring; ++ int i; + + switch (me_id) { + case 0: +- if (pipe_id == 0) +- amdgpu_fence_process(&adev->gfx.gfx_ring[0]); +- else +- amdgpu_fence_process(&adev->gfx.gfx_ring[1]); ++ /* ++ * MES splits gfx HQDs per (me,pipe): KGQ owns queue=0, ++ * userq gfx owns queue>=1 (see amdgpu_mes_get_hqd_mask). ++ * Require a strict (me,pipe,queue) match so userq gfx ++ * EOPs fall through to amdgpu_userq_process_fence_irq(). ++ */ ++ for (i = 0; i < adev->gfx.num_gfx_rings; i++) { ++ ring = &adev->gfx.gfx_ring[i]; ++ if ((ring->me == me_id) && ++ (ring->pipe == pipe_id) && ++ (ring->queue == queue_id)) { ++ amdgpu_fence_process(ring); ++ return 0; ++ } ++ } + break; + case 1: + case 2: +@@ -6543,13 +6551,20 @@ static int gfx_v11_0_eop_irq(struct amdg + */ + if ((ring->me == me_id) && + (ring->pipe == pipe_id) && +- (ring->queue == queue_id)) ++ (ring->queue == queue_id)) { + amdgpu_fence_process(ring); ++ return 0; ++ } + } + break; ++ default: ++ break; + } + } + ++ if (adev->enable_mes && doorbell_offset) ++ amdgpu_userq_process_fence_irq(adev, doorbell_offset); ++ + return 0; + } + diff --git a/queue-7.1/drm-amdgpu-gfx12-fix-eop-interrupt-routing-for-kq-and-userq.patch b/queue-7.1/drm-amdgpu-gfx12-fix-eop-interrupt-routing-for-kq-and-userq.patch new file mode 100644 index 0000000000..8145688cd9 --- /dev/null +++ b/queue-7.1/drm-amdgpu-gfx12-fix-eop-interrupt-routing-for-kq-and-userq.patch @@ -0,0 +1,98 @@ +From 128abbbfa913e7e099b75ae652cc90cfd66c6d6b Mon Sep 17 00:00:00 2001 +From: Jesse Zhang +Date: Thu, 11 Jun 2026 10:26:04 +0800 +Subject: drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq + +From: Jesse Zhang + +commit 128abbbfa913e7e099b75ae652cc90cfd66c6d6b upstream. + +Try KQ by ring_id first (KCQ and UQ never share a HW slot); fall back +to amdgpu_userq_process_fence_irq() on miss, since KCQ EOPs were +misrouted into the userq fence path when enable_mes is true. + +Require a strict (me,pipe,queue) match in the gfx case, then userq gfx +EOPs fall through to amdgpu_userq_process_fence_irq(). + +Suggested-by: Alex Deucher +Signed-off-by: Jesse Zhang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 6c1f4f7ff08448e0e18cd7fc4e59d6c96a36f25d) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 43 ++++++++++++++++++++++----------- + 1 file changed, 29 insertions(+), 14 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +@@ -4854,25 +4854,33 @@ static int gfx_v12_0_eop_irq(struct amdg + struct amdgpu_iv_entry *entry) + { + u32 doorbell_offset = entry->src_data[0]; +- u8 me_id, pipe_id, queue_id; +- struct amdgpu_ring *ring; +- int i; + + DRM_DEBUG("IH: CP EOP\n"); + +- if (adev->enable_mes && doorbell_offset) { +- amdgpu_userq_process_fence_irq(adev, doorbell_offset); +- } else { +- me_id = (entry->ring_id & 0x0c) >> 2; +- pipe_id = (entry->ring_id & 0x03) >> 0; +- queue_id = (entry->ring_id & 0x70) >> 4; ++ if (!adev->gfx.disable_kq) { ++ u8 me_id = (entry->ring_id & 0x0c) >> 2; ++ u8 pipe_id = (entry->ring_id & 0x03) >> 0; ++ u8 queue_id = (entry->ring_id & 0x70) >> 4; ++ struct amdgpu_ring *ring; ++ int i; + + switch (me_id) { + case 0: +- if (pipe_id == 0) +- amdgpu_fence_process(&adev->gfx.gfx_ring[0]); +- else +- amdgpu_fence_process(&adev->gfx.gfx_ring[1]); ++ /* ++ * MES splits gfx HQDs per (me,pipe): KGQ owns queue=0, ++ * userq gfx owns queue>=1 (see amdgpu_mes_get_hqd_mask). ++ * Require a strict (me,pipe,queue) match so userq gfx ++ * EOPs fall through to amdgpu_userq_process_fence_irq(). ++ */ ++ for (i = 0; i < adev->gfx.num_gfx_rings; i++) { ++ ring = &adev->gfx.gfx_ring[i]; ++ if ((ring->me == me_id) && ++ (ring->pipe == pipe_id) && ++ (ring->queue == queue_id)) { ++ amdgpu_fence_process(ring); ++ return 0; ++ } ++ } + break; + case 1: + case 2: +@@ -4884,13 +4892,20 @@ static int gfx_v12_0_eop_irq(struct amdg + */ + if ((ring->me == me_id) && + (ring->pipe == pipe_id) && +- (ring->queue == queue_id)) ++ (ring->queue == queue_id)) { + amdgpu_fence_process(ring); ++ return 0; ++ } + } + break; ++ default: ++ break; + } + } + ++ if (adev->enable_mes && doorbell_offset) ++ amdgpu_userq_process_fence_irq(adev, doorbell_offset); ++ + return 0; + } + diff --git a/queue-7.1/drm-amdgpu-gfx12-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-gfx12-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..3c6ef6b20a --- /dev/null +++ b/queue-7.1/drm-amdgpu-gfx12-replace-bug_on-with-warn_on.patch @@ -0,0 +1,71 @@ +From cd3b3efa1ced05528d9128755338baa62a6b562d Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:21:58 -0400 +Subject: drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit cd3b3efa1ced05528d9128755338baa62a6b562d upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit f952076f76d62f783e8ba4995a7c400d39354ccf) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c +@@ -440,7 +440,7 @@ static void gfx_v12_0_wait_reg_mem(struc + WAIT_REG_MEM_ENGINE(eng_sel))); + + if (mem_space) +- BUG_ON(addr0 & 0x3); /* Dword align */ ++ WARN_ON(addr0 & 0x3); /* Dword align */ + amdgpu_ring_write(ring, addr0); + amdgpu_ring_write(ring, addr1); + amdgpu_ring_write(ring, ref); +@@ -4459,7 +4459,7 @@ static void gfx_v12_0_ring_emit_ib_gfx(s + control |= ib->length_dw | (vmid << 24); + + amdgpu_ring_write(ring, header); +- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */ ++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */ + amdgpu_ring_write(ring, + #ifdef __BIG_ENDIAN + (2 << 0) | +@@ -4478,7 +4478,7 @@ static void gfx_v12_0_ring_emit_ib_compu + u32 control = INDIRECT_BUFFER_VALID | ib->length_dw | (vmid << 24); + + amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2)); +- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */ ++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */ + amdgpu_ring_write(ring, + #ifdef __BIG_ENDIAN + (2 << 0) | +@@ -4509,9 +4509,9 @@ static void gfx_v12_0_ring_emit_fence(st + * aligned if only send 32bit data low (discard data high) + */ + if (write64bit) +- BUG_ON(addr & 0x7); ++ WARN_ON(addr & 0x7); + else +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -4559,9 +4559,6 @@ static void gfx_v12_0_ring_emit_fence_ki + { + struct amdgpu_device *adev = ring->adev; + +- /* we only allocate 32bit for each seq wb address */ +- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT); +- + /* write fence seq to the "addr" */ + amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3)); + amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) | diff --git a/queue-7.1/drm-amdgpu-gfx12.1-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-gfx12.1-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..1ccb332bc9 --- /dev/null +++ b/queue-7.1/drm-amdgpu-gfx12.1-replace-bug_on-with-warn_on.patch @@ -0,0 +1,62 @@ +From 6560e6bd76127844e39f09fa591c2791dc7932e8 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:22:53 -0400 +Subject: drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit 6560e6bd76127844e39f09fa591c2791dc7932e8 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit e4d99e04b2e9b13b97d3b17804c735f62689db23) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c +@@ -248,7 +248,7 @@ static void gfx_v12_1_wait_reg_mem(struc + WAIT_REG_MEM_FUNCTION(3))); /* equal */ + + if (mem_space) +- BUG_ON(addr0 & 0x3); /* Dword align */ ++ WARN_ON(addr0 & 0x3); /* Dword align */ + amdgpu_ring_write(ring, addr0); + amdgpu_ring_write(ring, addr1); + amdgpu_ring_write(ring, ref); +@@ -3373,7 +3373,7 @@ static void gfx_v12_1_ring_emit_ib_compu + } + + amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2)); +- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */ ++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */ + amdgpu_ring_write(ring, + #ifdef __BIG_ENDIAN + (2 << 0) | +@@ -3406,9 +3406,9 @@ static void gfx_v12_1_ring_emit_fence(st + * aligned if only send 32bit data low (discard data high) + */ + if (write64bit) +- BUG_ON(addr & 0x7); ++ WARN_ON(addr & 0x7); + else +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -3455,9 +3455,6 @@ static void gfx_v12_1_ring_emit_fence_ki + { + struct amdgpu_device *adev = ring->adev; + +- /* we only allocate 32bit for each seq wb address */ +- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT); +- + /* write fence seq to the "addr" */ + amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3)); + amdgpu_ring_write(ring, (WRITE_DATA_DST_SEL(5) | WR_CONFIRM)); diff --git a/queue-7.1/drm-amdgpu-gfx8-drop-unecessary-bug_on.patch b/queue-7.1/drm-amdgpu-gfx8-drop-unecessary-bug_on.patch new file mode 100644 index 0000000000..e236997161 --- /dev/null +++ b/queue-7.1/drm-amdgpu-gfx8-drop-unecessary-bug_on.patch @@ -0,0 +1,32 @@ +From 84a1a8a952ab4b8c23c5dd1f2eea4049cb4914f5 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:17:59 -0400 +Subject: drm/amdgpu/gfx8: drop unecessary BUG_ON() + +From: Alex Deucher + +commit 84a1a8a952ab4b8c23c5dd1f2eea4049cb4914f5 upstream. + +There's no need to crash the kernel for this case. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -6252,9 +6252,6 @@ static void gfx_v8_0_ring_emit_fence_com + static void gfx_v8_0_ring_emit_fence_kiq(struct amdgpu_ring *ring, u64 addr, + u64 seq, unsigned int flags) + { +- /* we only allocate 32bit for each seq wb address */ +- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT); +- + /* write fence seq to the "addr" */ + amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3)); + amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) | diff --git a/queue-7.1/drm-amdgpu-gfx9-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-gfx9-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..892b29b24a --- /dev/null +++ b/queue-7.1/drm-amdgpu-gfx9-replace-bug_on-with-warn_on.patch @@ -0,0 +1,61 @@ +From 6302be10b521f5106ce01eb5a724b9e7945a5061 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:14:59 -0400 +Subject: drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit 6302be10b521f5106ce01eb5a724b9e7945a5061 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -1183,7 +1183,7 @@ static void gfx_v9_0_wait_reg_mem(struct + WAIT_REG_MEM_ENGINE(eng_sel))); + + if (mem_space) +- BUG_ON(addr0 & 0x3); /* Dword align */ ++ WARN_ON(addr0 & 0x3); /* Dword align */ + amdgpu_ring_write(ring, addr0); + amdgpu_ring_write(ring, addr1); + amdgpu_ring_write(ring, ref); +@@ -5466,7 +5466,7 @@ static void gfx_v9_0_ring_emit_ib_gfx(st + } + + amdgpu_ring_write(ring, header); +- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */ ++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */ + amdgpu_ring_write(ring, + #ifdef __BIG_ENDIAN + (2 << 0) | +@@ -5562,7 +5562,7 @@ static void gfx_v9_0_ring_emit_ib_comput + } + + amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2)); +- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */ ++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */ + amdgpu_ring_write(ring, + #ifdef __BIG_ENDIAN + (2 << 0) | +@@ -5603,9 +5603,9 @@ static void gfx_v9_0_ring_emit_fence(str + * aligned if only send 32bit data low (discard data high) + */ + if (write64bit) +- BUG_ON(addr & 0x7); ++ WARN_ON(addr & 0x7); + else +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); diff --git a/queue-7.1/drm-amdgpu-gfx9.4.3-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-gfx9.4.3-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..be7cee1d73 --- /dev/null +++ b/queue-7.1/drm-amdgpu-gfx9.4.3-replace-bug_on-with-warn_on.patch @@ -0,0 +1,62 @@ +From 00f4050f7c367d7bdce347ca279ce467c434cf15 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:42:35 -0400 +Subject: drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit 00f4050f7c367d7bdce347ca279ce467c434cf15 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit 5676593d08998d7a6d9e2d51d6b54b3820e3755c) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c +@@ -405,7 +405,7 @@ static void gfx_v9_4_3_wait_reg_mem(stru + WAIT_REG_MEM_ENGINE(eng_sel))); + + if (mem_space) +- BUG_ON(addr0 & 0x3); /* Dword align */ ++ WARN_ON(addr0 & 0x3); /* Dword align */ + amdgpu_ring_write(ring, addr0); + amdgpu_ring_write(ring, addr1); + amdgpu_ring_write(ring, ref); +@@ -2857,7 +2857,7 @@ static void gfx_v9_4_3_ring_emit_ib_comp + } + + amdgpu_ring_write(ring, PACKET3(PACKET3_INDIRECT_BUFFER, 2)); +- BUG_ON(ib->gpu_addr & 0x3); /* Dword align */ ++ WARN_ON(ib->gpu_addr & 0x3); /* Dword align */ + amdgpu_ring_write(ring, + #ifdef __BIG_ENDIAN + (2 << 0) | +@@ -2891,9 +2891,9 @@ static void gfx_v9_4_3_ring_emit_fence(s + * aligned if only send 32bit data low (discard data high) + */ + if (write64bit) +- BUG_ON(addr & 0x7); ++ WARN_ON(addr & 0x7); + else +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -2953,9 +2953,6 @@ static void gfx_v9_4_3_ring_emit_fence_k + { + struct amdgpu_device *adev = ring->adev; + +- /* we only allocate 32bit for each seq wb address */ +- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT); +- + /* write fence seq to the "addr" */ + amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3)); + amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) | diff --git a/queue-7.1/drm-amdgpu-invoke-pm_genpd_remove-before-freeing-genpd.patch b/queue-7.1/drm-amdgpu-invoke-pm_genpd_remove-before-freeing-genpd.patch new file mode 100644 index 0000000000..f81c1d9196 --- /dev/null +++ b/queue-7.1/drm-amdgpu-invoke-pm_genpd_remove-before-freeing-genpd.patch @@ -0,0 +1,34 @@ +From 28c9b3c5dc35cc790d11e26ca3fc6e068be63998 Mon Sep 17 00:00:00 2001 +From: Ce Sun +Date: Mon, 22 Jun 2026 22:58:16 +0800 +Subject: drm/amdgpu: invoke pm_genpd_remove() before freeing genpd + +From: Ce Sun + +commit 28c9b3c5dc35cc790d11e26ca3fc6e068be63998 upstream. + +Call pm_genpd_remove() to unregister from global list prior to releasing +acp_genpd memory, and clear the pointer after free. + +Signed-off-by: Ce Sun +Reviewed-by: Tao Zhou +Signed-off-by: Alex Deucher +(cherry picked from commit cd8650d7a91ee8b768e202354672553faa5cc1f2) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c +@@ -560,7 +560,9 @@ out: + + mfd_remove_devices(adev->acp.parent); + kfree(adev->acp.acp_res); ++ pm_genpd_remove(&adev->acp.acp_genpd->gpd); + kfree(adev->acp.acp_genpd); ++ adev->acp.acp_genpd = NULL; + kfree(adev->acp.acp_cell); + + return ret; diff --git a/queue-7.1/drm-amdgpu-jpeg-fix-jpeg_v4_0_3_is_idle-detection.patch b/queue-7.1/drm-amdgpu-jpeg-fix-jpeg_v4_0_3_is_idle-detection.patch new file mode 100644 index 0000000000..e4124df253 --- /dev/null +++ b/queue-7.1/drm-amdgpu-jpeg-fix-jpeg_v4_0_3_is_idle-detection.patch @@ -0,0 +1,37 @@ +From c44af3810fc8b3adf6910a332038aa566560c8fa Mon Sep 17 00:00:00 2001 +From: Boyuan Zhang +Date: Fri, 26 Jun 2026 10:39:26 -0400 +Subject: drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection + +From: Boyuan Zhang + +commit c44af3810fc8b3adf6910a332038aa566560c8fa upstream. + +jpeg_v4_0_3_is_idle() initializes ret to false and then accumulates ring +idle status using &=. Since false & condition always remains false, the +function can never report the JPEG block as idle. + +Initialize ret to true so the function returns true only when all JPEG +rings report RB_JOB_DONE. + +Signed-off-by: Boyuan Zhang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit e9df8e9d04e0593d17ddb069f3b7958991cd18c9) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c ++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c +@@ -1010,7 +1010,7 @@ void jpeg_v4_0_3_dec_ring_nop(struct amd + static bool jpeg_v4_0_3_is_idle(struct amdgpu_ip_block *ip_block) + { + struct amdgpu_device *adev = ip_block->adev; +- bool ret = false; ++ bool ret = true; + int i, j; + + for (i = 0; i < adev->jpeg.num_jpeg_inst; ++i) { diff --git a/queue-7.1/drm-amdgpu-jpeg-fix-jpeg_v5_0_1_is_idle-detection.patch b/queue-7.1/drm-amdgpu-jpeg-fix-jpeg_v5_0_1_is_idle-detection.patch new file mode 100644 index 0000000000..3cabfe4b0d --- /dev/null +++ b/queue-7.1/drm-amdgpu-jpeg-fix-jpeg_v5_0_1_is_idle-detection.patch @@ -0,0 +1,38 @@ +From efcedeececcf995fcf717b21e39aa7c446fa3bf7 Mon Sep 17 00:00:00 2001 +From: Boyuan Zhang +Date: Wed, 24 Jun 2026 09:50:01 -0400 +Subject: drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection + +From: Boyuan Zhang + +commit efcedeececcf995fcf717b21e39aa7c446fa3bf7 upstream. + +jpeg_v5_0_1_is_idle() initializes ret to false and then accumulates ring +idle status using &=. Since false & condition always remains false, the +function can never report the JPEG block as idle. + +Initialize ret to true so the function returns true only when all JPEG +rings report RB_JOB_DONE. + +Signed-off-by: Boyuan Zhang +Reviewed-by: David (Ming Qiang) Wu +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit 680adf5faeeabb4585f7aeb53681719e2d6c2f41) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c +@@ -657,7 +657,7 @@ static void jpeg_v5_0_1_dec_ring_set_wpt + static bool jpeg_v5_0_1_is_idle(struct amdgpu_ip_block *ip_block) + { + struct amdgpu_device *adev = ip_block->adev; +- bool ret = false; ++ bool ret = true; + int i, j; + + for (i = 0; i < adev->jpeg.num_jpeg_inst; ++i) { diff --git a/queue-7.1/drm-amdgpu-mes11-set-doorbell-offset-for-suspending-userq.patch b/queue-7.1/drm-amdgpu-mes11-set-doorbell-offset-for-suspending-userq.patch new file mode 100644 index 0000000000..62480fcc97 --- /dev/null +++ b/queue-7.1/drm-amdgpu-mes11-set-doorbell-offset-for-suspending-userq.patch @@ -0,0 +1,62 @@ +From 96f222efc9e798165079def83d7f94f22ca9c384 Mon Sep 17 00:00:00 2001 +From: Prike Liang +Date: Thu, 25 Jun 2026 10:31:00 +0800 +Subject: drm/amdgpu/mes11: set doorbell offset for suspending userq +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Prike Liang + +commit 96f222efc9e798165079def83d7f94f22ca9c384 upstream. + +Updating the union MESAPI__SUSPEND and union MESAPI__RESUME to +add the doorbell offset for suspending userq. + +Signed-off-by: Prike Liang +Acked-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 30af09db33696f7e0de5c0c505cbb0cb92b6e25b) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 2 ++ + drivers/gpu/drm/amd/include/mes_v11_api_def.h | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/mes_v11_0.c +@@ -557,6 +557,7 @@ static int mes_v11_0_suspend_gang(struct + mes_suspend_gang_pkt.gang_context_addr = input->gang_context_addr; + mes_suspend_gang_pkt.suspend_fence_addr = input->suspend_fence_addr; + mes_suspend_gang_pkt.suspend_fence_value = input->suspend_fence_value; ++ mes_suspend_gang_pkt.doorbell_offset = input->doorbell_offset; + + return mes_v11_0_submit_pkt_and_poll_completion(mes, + &mes_suspend_gang_pkt, sizeof(mes_suspend_gang_pkt), +@@ -576,6 +577,7 @@ static int mes_v11_0_resume_gang(struct + + mes_resume_gang_pkt.resume_all_gangs = input->resume_all_gangs; + mes_resume_gang_pkt.gang_context_addr = input->gang_context_addr; ++ mes_resume_gang_pkt.doorbell_offset = input->doorbell_offset; + + return mes_v11_0_submit_pkt_and_poll_completion(mes, + &mes_resume_gang_pkt, sizeof(mes_resume_gang_pkt), +--- a/drivers/gpu/drm/amd/include/mes_v11_api_def.h ++++ b/drivers/gpu/drm/amd/include/mes_v11_api_def.h +@@ -427,6 +427,7 @@ union MESAPI__SUSPEND { + uint32_t suspend_fence_value; + + struct MES_API_STATUS api_status; ++ uint32_t doorbell_offset; + }; + + uint32_t max_dwords_in_api[API_FRAME_SIZE_IN_DWORDS]; +@@ -444,6 +445,7 @@ union MESAPI__RESUME { + uint64_t gang_context_addr; + + struct MES_API_STATUS api_status; ++ uint32_t doorbell_offset; + }; + + uint32_t max_dwords_in_api[API_FRAME_SIZE_IN_DWORDS]; diff --git a/queue-7.1/drm-amdgpu-reject-mapping-a-reserved-doorbell-to-a-new-queue.patch b/queue-7.1/drm-amdgpu-reject-mapping-a-reserved-doorbell-to-a-new-queue.patch new file mode 100644 index 0000000000..32c0eb7d14 --- /dev/null +++ b/queue-7.1/drm-amdgpu-reject-mapping-a-reserved-doorbell-to-a-new-queue.patch @@ -0,0 +1,52 @@ +From a609b6278bf3cde17eeee6620091465521e4b02c Mon Sep 17 00:00:00 2001 +From: Zhu Lingshan +Date: Wed, 24 Jun 2026 15:52:35 +0800 +Subject: drm/amdgpu: reject mapping a reserved doorbell to a new queue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhu Lingshan + +commit a609b6278bf3cde17eeee6620091465521e4b02c upstream. + +When creating an user-queue, the user space +provides a doorbell BO handle and an offset within +the bo to obtain a doorbell. + +However current implementation using xa_store_irq() +to store a doorbell, which allows a later queue created +with the same BO and offset parameters to overwrite an +existing queue and doorbell mapping. + +This can cause problems like misrouting fence IRQ +processing to a wrong queue, and mislead the cleanup +process of one queue erasing the mapping of another queue. + +This commit fixes this issue by replacing xa_store_irq with +xa_insert_irq, which rejects mapping a reserved +doorbell to a newly created queue + +Signed-off-by: Zhu Lingshan +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 6244eae22966350db52faf9c1369d3b2ffc5de4e) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c +@@ -689,8 +689,8 @@ amdgpu_userq_create(struct drm_file *fil + /* Update VM owner at userq submit-time for page-fault attribution. */ + amdgpu_vm_set_task_info(&fpriv->vm); + +- r = xa_err(xa_store_irq(&adev->userq_doorbell_xa, index, queue, +- GFP_KERNEL)); ++ r = xa_insert_irq(&adev->userq_doorbell_xa, index, queue, ++ GFP_KERNEL); + if (r) + goto clean_mqd; + diff --git a/queue-7.1/drm-amdgpu-sdma4.4.2-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-sdma4.4.2-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..2e7a530477 --- /dev/null +++ b/queue-7.1/drm-amdgpu-sdma4.4.2-replace-bug_on-with-warn_on.patch @@ -0,0 +1,40 @@ +From 40cdbe9fa424cc6264a7aed93a04bd7d69109d9e Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:44:11 -0400 +Subject: drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit 40cdbe9fa424cc6264a7aed93a04bd7d69109d9e upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit fa4f86a148271e325e95287630a3a15a9cd35fdc) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c +@@ -457,7 +457,7 @@ static void sdma_v4_4_2_ring_emit_fence( + /* write the fence */ + amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE)); + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -467,7 +467,7 @@ static void sdma_v4_4_2_ring_emit_fence( + addr += 4; + amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE)); + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(seq)); diff --git a/queue-7.1/drm-amdgpu-sdma7.1-replace-bug_on-with-warn_on.patch b/queue-7.1/drm-amdgpu-sdma7.1-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..fd53fa8eb9 --- /dev/null +++ b/queue-7.1/drm-amdgpu-sdma7.1-replace-bug_on-with-warn_on.patch @@ -0,0 +1,40 @@ +From 767648c18d7872bbf54481ba846e055f7e1c0213 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:29:00 -0400 +Subject: drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit 767648c18d7872bbf54481ba846e055f7e1c0213 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v7_1.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v7_1.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v7_1.c +@@ -331,7 +331,7 @@ static void sdma_v7_1_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */ + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -342,7 +342,7 @@ static void sdma_v7_1_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(seq)); diff --git a/queue-7.1/drm-amdgpu-vce-fix-integer-overflow-in-image-size.patch b/queue-7.1/drm-amdgpu-vce-fix-integer-overflow-in-image-size.patch new file mode 100644 index 0000000000..db7cfcdf31 --- /dev/null +++ b/queue-7.1/drm-amdgpu-vce-fix-integer-overflow-in-image-size.patch @@ -0,0 +1,61 @@ +From 186bfdc4e26d019b2e7570cb121964a1d89b2e5b Mon Sep 17 00:00:00 2001 +From: Boyuan Zhang +Date: Mon, 25 May 2026 11:34:27 -0400 +Subject: drm/amdgpu/vce: fix integer overflow in image size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Boyuan Zhang + +commit 186bfdc4e26d019b2e7570cb121964a1d89b2e5b upstream. + +Fix a security vulnerability where malicious VCE command streams +with oversized dimensions (e.g. 65536×65536) cause 32-bit integer +overflow, wrapping the calculated buffer size to 0. This bypasses +validation and allows GPU firmware to perform out-of-bound memory +access. + +The fix uses 64-bit arithmetic to detect overflow and rejects +invalid dimensions before they reach the hardware. + +V2: remove redundant check +V3: modify max height value +V4: remove size64 + +Signed-off-by: Boyuan Zhang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +@@ -877,9 +877,20 @@ int amdgpu_vce_ring_parse_cs(struct amdg + goto out; + } + +- *size = amdgpu_ib_get_value(ib, idx + 8) * +- amdgpu_ib_get_value(ib, idx + 10) * +- 8 * 3 / 2; ++ uint32_t width, height; ++ width = amdgpu_ib_get_value(ib, idx + 8); ++ height = amdgpu_ib_get_value(ib, idx + 10); ++ ++ if (width == 0 || height == 0 || ++ width > 4096 || height > 2304) { ++ DRM_ERROR("invalid VCE image size: %ux%u\n", ++ width, height); ++ r = -EINVAL; ++ goto out; ++ } ++ ++ *size = width * height * 8 * 3 / 2; ++ + break; + + case 0x04000001: /* config extension */ diff --git a/queue-7.1/drm-amdgpu-vcn4-avoid-rereading-ib-param-length.patch b/queue-7.1/drm-amdgpu-vcn4-avoid-rereading-ib-param-length.patch new file mode 100644 index 0000000000..f9a2bee69f --- /dev/null +++ b/queue-7.1/drm-amdgpu-vcn4-avoid-rereading-ib-param-length.patch @@ -0,0 +1,80 @@ +From 3b4082fabc67c9780b06eb959e59dd92fa79c0f0 Mon Sep 17 00:00:00 2001 +From: Boyuan Zhang +Date: Thu, 21 May 2026 09:59:37 -0400 +Subject: drm/amdgpu/vcn4: avoid rereading IB param length + +From: Boyuan Zhang + +commit 3b4082fabc67c9780b06eb959e59dd92fa79c0f0 upstream. + +Reuse the parameter length returned by +vcn_v4_0_enc_find_ib_param() instead of rereading it from +the IB. + +This avoids a potential TOCTOU issue if the IB contents +change between reads. + +Signed-off-by: Boyuan Zhang +Reviewed-by: David Rosca +Signed-off-by: Alex Deucher +(cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c +@@ -1927,14 +1927,17 @@ out: + #define RENCODE_IB_PARAM_SESSION_INIT 0x00000003 + + /* return the offset in ib if id is found, -1 otherwise */ +-static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int start) ++static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int start, uint32_t *length) + { + int i; + uint32_t len; + + for (i = start; (len = amdgpu_ib_get_value(ib, i)) >= 8; i += len / 4) { +- if (amdgpu_ib_get_value(ib, i + 1) == id) ++ if (amdgpu_ib_get_value(ib, i + 1) == id) { ++ if (length) ++ *length = len; + return i; ++ } + } + return -1; + } +@@ -1944,14 +1947,14 @@ static int vcn_v4_0_ring_patch_cs_in_pla + struct amdgpu_ib *ib) + { + struct amdgpu_ring *ring = amdgpu_job_ring(job); +- uint32_t val; ++ uint32_t val, len; + int idx = 0, sidx; + + /* The first instance can decode anything */ + if (!ring->me) + return 0; + +- while ((idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, idx)) >= 0) { ++ while ((idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, idx, &len)) >= 0) { + val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */ + if (val == RADEON_VCN_ENGINE_TYPE_DECODE) { + uint32_t valid_buf_flag = amdgpu_ib_get_value(ib, idx + 6); +@@ -1964,12 +1967,12 @@ static int vcn_v4_0_ring_patch_cs_in_pla + amdgpu_ib_get_value(ib, idx + 8); + return vcn_v4_0_dec_msg(p, job, msg_buffer_addr); + } else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) { +- sidx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, idx); ++ sidx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, idx, NULL); + if (sidx >= 0 && + amdgpu_ib_get_value(ib, sidx + 2) == RENCODE_ENCODE_STANDARD_AV1) + return vcn_v4_0_limit_sched(p, job); + } +- idx += amdgpu_ib_get_value(ib, idx) / 4; ++ idx += len / 4; + } + return 0; + } diff --git a/queue-7.1/drm-dp_mst-handle-torn-down-topology-gracefully-in-drm_dp_mst_topology_queue_probe.patch b/queue-7.1/drm-dp_mst-handle-torn-down-topology-gracefully-in-drm_dp_mst_topology_queue_probe.patch new file mode 100644 index 0000000000..0f13cb7c24 --- /dev/null +++ b/queue-7.1/drm-dp_mst-handle-torn-down-topology-gracefully-in-drm_dp_mst_topology_queue_probe.patch @@ -0,0 +1,57 @@ +From 613059875958e7b217b250ed14c3b189f9488421 Mon Sep 17 00:00:00 2001 +From: Luca Coelho +Date: Mon, 22 Jun 2026 17:03:58 +0300 +Subject: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() + +From: Luca Coelho + +commit 613059875958e7b217b250ed14c3b189f9488421 upstream. + +A hotplug or link-loss event can tear down the MST topology +(setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently +with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check +is already performed under mgr->lock, the condition is not a programming +error but a valid race -- the topology was valid when the caller decided +to call this function, but was torn down before the lock was acquired. + +Replace the drm_WARN_ON() with a graceful early return. This eliminates +spurious kernel warnings and the resulting compositor crashes observed +when connecting/disconnecting DP MST monitors, while keeping the correct +behavior of doing nothing when MST is not active. A drm_dbg_mst() trace +is added so the skipped probe remains observable under MST debug logging. + +The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst() +already catches the case where the topology is initialized twice, so no +diagnostic coverage is lost. + +Fixes: dbaeef363ea5 ("drm/dp_mst: Add a helper to queue a topology probe") +Cc: Imre Deak +Cc: Lyude Paul +Cc: stable@vger.kernel.org +Cc: intel-gfx@lists.freedesktop.org +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Jonas Emilsson +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/all/20260503034533.1023686-1-jonas.emilsson@gmail.com +Acked-by: Imre Deak +Link: https://patch.msgid.link/20260622140532.526722-1-luciano.coelho@intel.com +Signed-off-by: Maarten Lankhorst +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -3740,8 +3740,10 @@ void drm_dp_mst_topology_queue_probe(str + { + mutex_lock(&mgr->lock); + +- if (drm_WARN_ON(mgr->dev, !mgr->mst_state || !mgr->mst_primary)) ++ if (!mgr->mst_state || !mgr->mst_primary) { ++ drm_dbg_kms(mgr->dev, "queue_probe skipped: topology torn down\n"); + goto out_unlock; ++ } + + drm_dp_mst_topology_mgr_invalidate_mstb(mgr->mst_primary); + drm_dp_mst_queue_probe_work(mgr); diff --git a/queue-7.1/series b/queue-7.1/series index 6ccb13232f..b1dd494c4e 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -693,3 +693,27 @@ tipc-clear-sock-sk-on-the-failed-insert-path-in-tipc_sk_create.patch vsock-virtio-collapse-receive-queue-under-memory-pressure.patch vxlan-mdb-fix-source-list-corruption-on-a-failed-replace.patch watchdog-s32g_wdt-remove-incorrect-options-in-watchdog_info-struct.patch +drm-amd-pm-fix-amdgpu_pm_info-power-display-units.patch +drm-amd-pm-make-pp_features-read-only-when-scpm-is-enabled.patch +drm-amdgpu-gfx10-replace-bug_on-with-warn_on.patch +drm-amdgpu-gfx12.1-replace-bug_on-with-warn_on.patch +drm-amdgpu-gfx11-fix-eop-interrupt-routing-for-kq-and-userq.patch +drm-amdgpu-gfx12-fix-eop-interrupt-routing-for-kq-and-userq.patch +drm-amdgpu-gfx12-replace-bug_on-with-warn_on.patch +drm-amdgpu-gfx8-drop-unecessary-bug_on.patch +drm-amdgpu-gfx9.4.3-replace-bug_on-with-warn_on.patch +drm-amdgpu-gfx9-replace-bug_on-with-warn_on.patch +drm-amdgpu-jpeg-fix-jpeg_v4_0_3_is_idle-detection.patch +drm-amdgpu-jpeg-fix-jpeg_v5_0_1_is_idle-detection.patch +drm-amdgpu-mes11-set-doorbell-offset-for-suspending-userq.patch +drm-amdgpu-sdma4.4.2-replace-bug_on-with-warn_on.patch +drm-amdgpu-sdma7.1-replace-bug_on-with-warn_on.patch +drm-amdgpu-vce-fix-integer-overflow-in-image-size.patch +drm-amdgpu-vcn4-avoid-rereading-ib-param-length.patch +drm-dp_mst-handle-torn-down-topology-gracefully-in-drm_dp_mst_topology_queue_probe.patch +drm-amdgpu-fix-division-by-zero-with-invalid-uvd-dimensions.patch +drm-amdgpu-fix-kernel-panic-during-driver-load-failure.patch +drm-amdgpu-fix-resource-leak-on-acp-reset-timeout.patch +drm-amdgpu-invoke-pm_genpd_remove-before-freeing-genpd.patch +drm-amdgpu-reject-mapping-a-reserved-doorbell-to-a-new-queue.patch +drm-amdgpu-fix-aperture-mapping-leak.patch