summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-08drm/amdgpu: add support for SMU version 15.0.9Kanala Ramalingeswara Reddy
Initialize SMU Version 15_0_9 Signed-off-by: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com> Signed-off-by: Granthali Vinodkumar Dhandar <granthali.vinodkumardhandar@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1dfd4e84b5beec353a81d61af9eaf4e5a56e0c57)
2026-07-08drm/amdgpu: add support for PSP version 15.0.9Kanala Ramalingeswara Reddy
Initialize PSP Version 15_0_9 Signed-off-by: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com> Signed-off-by: Granthali Vinodkumar Dhandar <granthali.vinodkumardhandar@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ef71f00173228904763552b7405169023f8034a8)
2026-07-08drm/xe: free madvise VMA array on L2 flush failureGuangshuo Li
xe_vm_madvise_ioctl() allocates madvise_range.vmas in get_vmas(). After get_vmas() succeeds with at least one VMA, error paths must go through free_vmas so the array is released before the madvise details are destroyed. The L2 flush validation path added for PAT madvise rejects some SVM/userptr ranges after get_vmas() has succeeded, but jumps directly to madv_fini. This skips kfree(madvise_range.vmas), leaking the VMA array on each failed ioctl. Jump to free_vmas instead, matching the other validation failure paths after get_vmas() has succeeded. Fixes: 4f39a194d41e ("drm/xe/xe3p_lpg: Restrict UAPI to enable L2 flush optimization") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260708073422.725186-1-lgs201920130244@gmail.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-08selftests/bpf: Skip res_spin_lock_stress if no perf supportMaxim Khmelevskii
Probe PMU support before loading bpf_test_rqspinlock.ko, otherwise the test fails with not obvious error without proper perf event support: Failed to load bpf_test_rqspinlock.ko into the kernel: -2 serial_test_res_spin_lock_stress:FAIL:load module AA unexpected error: -22 (errno 2) Reported-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Link: https://lore.kernel.org/bpf/20260708104729.1248234-2-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-08media: i2c: imx678: Add driver for Sony IMX678Jai Luthra
Add a V4L2 subdev driver for the Sony IMX678 image sensor. IMX678 is a diagonal 8.86 mm (Type 1/1.8) CMOS active pixel type solid-state image sensor with a square pixel array and 8.40 M effective pixels. The following features are supported by this driver: - MIPI RAW12 output - Monochrome and Color (Bayer filter) variants - Multiple input clock frequencies - Multiple link frequencies - VBLANK and HBLANK control for variable framerate - VFLIP and HFLIP control for flipping readout - Exposure and analogue gain control - Test pattern control Following features are not currently supported: - MIPI RAW10 output - Pixel-perfect crop reporting, accounting for the shift-by-1 when doing HFLIP/VFLIP where the sensor maintains RGGB bayer ordering Along with the ones below which depend on the new raw sensor model: - Embedded data stream - Freely configurable cropping - Increased framerate when cropping - 2x2 binning support Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com> Reviewed-by: Tarang Raval <tarang.raval@siliconsignals.io> [Sakari Ailus: Add an extra newline to the enum_mbus_code op.] Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-08dt-bindings: media: i2c: Add Sony IMX678Jai Luthra
Sony IMX678 is an 8.4 Megapixel (3856x2180) CMOS sensor, that can output pixels over MIPI CSI-2 bus. Add bindings for it. Runtime detection for mono vs color variant of this sensor is feasible by reading a register, but it's not always desirable given the sensor needs to be powered on for it, potentially flashing a privacy LED or wasting precious boot time. The manufacturer or vendor knows which sensor variant they are putting on their board, so we define the compatible property to expect the (color/mono) specific name of the sensor, along with a generic fallback. Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
2026-07-08nvme: don't reference NS after unlocking in nvme_ns_head_ctrl_ioctl()John Garry
In nvme_ns_head_ctrl_ioctl(), once we drop the SRCU read lock we should not reference the NS to lookup the controller, so use the available controller pointer directly. Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-07-08nvme: swap synchronization ordering in nvme_remove_head()John Garry
sashiko bot reported a potential issue in the requeue handling in [0] - the code there is same as the NVMe driver. The issue is that when we schedule the requeue work, if a bio is added to the requeue list afterwards in nvme_ns_head_submit_bio(), it is missed by the requeue worker. This issue can be recreated by hacking a large delay in the bio submission requeue path: } else if (nvme_available_path(head)) { dev_warn_ratelimited(dev, "no usable path - requeuing I/O\n"); + msleep(30000); spin_lock_irq(&head->requeue_lock); bio_list_add(&head->requeue_list, bio); spin_unlock_irq(&head->requeue_lock); Then if we issue a write after removing all paths, a hang can be seen: # echo 20 > /sys/devices/virtual/nvme-subsystem/nvme-subsys1/nvme1n1/delayed_removal_secs # # ./ini_nvme_teardown.sh [ 25.877224] nvme nvme1: Removing ctrl: NQN "nvme-test-target" [ 25.939569] nvme nvme2: Removing ctrl: NQN "nvme-test-target" # # xfs_io -d -C "pwrite -b 64k -V 1 -D 0 64k" /dev/nvme1n1p1 [ 29.883653] block nvme1n1: no usable path - requeuing I/O Fix by re-ordering the SRCU synchronization and scheduling the requeue work. [0] https://lore.kernel.org/linux-scsi/20260703102918.3723667-1-john.g.garry@oracle.com/T/#m72af1f29deb0ebfb2973464207f201f1be1f660c Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Nilay Shroff <nilay@linux.ibm.com> Signed-off-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-07-08selftests/bpf: Close fd on unexpected success in signed loaderDaniel Borkmann
The signature_enforced, signature_too_large, signature_zero_size and signature_bad_keyring subtests load a program that must be rejected, but leave the fd open if the kernel unexpectedly accepts the load: test_progs asserts record the failure and continue, so the fd would linger for the rest of the run. Just close it. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260708184107.369182-1-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-08NFS: Charge unstable writes by request size, not folio sizeBenjamin Coddington
nfs_folio_mark_unstable() and nfs_folio_clear_commit() charge and uncharge NR_WRITEBACK/WB_WRITEBACK by folio_nr_pages(folio) once per *request* added to or removed from a commit list. This is correct only when a folio has a single associated request. When pg_test splits a folio into N sub-folio requests (e.g. pNFS flexfiles striping with a stripe unit smaller than the folio size, or plain wsize-limited splitting), each of the N requests independently charges the whole folio's page count, inflating the accounting by a factor of N per folio. With large folios and small stripe units this reaches multiple orders of magnitude: a 2 MiB folio split into 512 4 KiB requests can charge up to 512x its real size, pushing global dirty+writeback accounting past the system's dirty threshold and forcing every buffered writer on the host into the hard-throttle path, including unrelated in-kernel NFS server threads sharing the box. Charge each request only for the pages it actually covers. Fixes: 0c493b5cf16e ("NFS: Convert buffered writes to use folios") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com> Assisted-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
2026-07-08NFSv4: include MAY_WRITE in open permission mask for O_TRUNCBenjamin Coddington
POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode. nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authorization gate for OPENs the client serves itself from a cached write delegation via the can_open_delegated() path in nfs4_try_open_cached(). The mask is derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a file the caller cannot write requests only MAY_READ and passes the local check. The OPEN is then satisfied locally and the truncation is issued to the server as a SETATTR(size=0) over the delegation stateid, which the server accepts under standard write-delegation semantics. POSIX requires that this open fail with EACCES. Include MAY_WRITE in the mask whenever O_TRUNC is set so the local check matches the access the server would have enforced. Suggested-by: Trond Myklebust <trondmy@kernel.org> Fixes: af22f94ae02a ("NFSv4: Simplify _nfs4_do_access()") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com> Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
2026-07-08regulator: mt6363: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260704124352.7981-1-pengpeng@iscas.ac.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-08regulator: mt6316: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260704122926.21586-1-pengpeng@iscas.ac.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-08ASoC: codecs: max98373-sdw: Propagate regcache_sync() errorsPengpeng Hou
max98373_resume() waits for SoundWire initialization, leaves cache-only mode, and replays cached register state. It currently ignores regcache_sync() failures and returns success. Propagate the error and restore cache-only/dirty state on failure. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://patch.msgid.link/20260704074044.45520-1-pengpeng@iscas.ac.cn Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-08selftests/sched_ext: Verify nohz_full tick behaviorAndrea Righi
Finite-slice EXT tasks need the periodic scheduler tick to expire their slices even when nohz_full is enabled. Add a regression test that selects a nohz_full CPU and exercises both infinite-to-finite and finite-to-finite slice transitions across an idle interval. For each finite task, verify that its ops.tick() callback is invoked. Skip the test when an allowed nohz_full CPU and a separate housekeeping CPU are not available. Signed-off-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-08sched_ext: Enable tick for finite slices on nohz_fullAndrea Righi
set_next_task_scx() updates the tick dependency before __schedule() updates rq->curr. When switching from a non-EXT task, such as idle, to an EXT task with a finite slice, sched_update_tick_dependency() checks the outgoing task and can allow the tick to remain stopped. The dependency can also be lost without a slice-type transition. After a finite-slice task leaves the CPU idle, the enqueue path can clear the dependency against the idle rq->curr. SCX_RQ_CAN_STOP_TICK still records a finite slice, so another finite task skips the transition block and can run without the ticks needed to expire its slice. The reverse mismatch can also happen when the last finite-slice EXT task is dequeued: sub_nr_running() updates the dependency before rq->curr changes, so the outgoing task state can keep the dependency set after the CPU goes idle. Fix this by unconditionally enabling the scheduler tick whenever a finite-slice EXT task is selected on a nohz_full CPU. Moreover, when the last runnable EXT task leaves, ignore the outgoing EXT slice state so the generic scheduler can correctly re-evaluate and clear the tick dependency. Fixes: 22a920209ab6 ("sched_ext: Implement tickless support") Signed-off-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-08drm/amdkfd: Check bounds on CRIU restore event idDavid Francis
The valid amdkfd event ids go from 0 to KFD_SIGNAL_EVENT_LIMIT - 1. During CRIU restore, ensure that the provided event ids are in that range. v2: No need for lower bound check since idr_alloc rejects negative inputs v3: Also change error message to reflect new error condition Reviewed-by: David Yat Sin <david.yatsin@amd.com> Signed-off-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: expose pasid of secondary contexts by debugfsZhu Lingshan
Current kfd debugfs interfaces only expose pasid of the primary process, this commit exposes pasid of secondary contexts by debugfs Just like entries under sysfs, the secondary contexts are named as context_<id> under its primary kfd process. The layout: /sys/kernel/debug/kfd/proc# tree . └── 5802 ├── context_0 │   ├── pasid_1025 │   └── pasid_63266 ├── context_1 │   ├── pasid_1025 │   └── pasid_63266 ├── pasid_1025 └── pasid_63266 Another fix is, kfd_debugfs_add_process may fail, this commit change it to return a meaningful value other than void Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amd/pm: fix smu14 power limit range calculationYang Wang
SMU14 derives the default PPT limit from SocketPowerLimitAc/Dc, but MsgLimits.Power may expose a different firmware limit for the same PPT0 throttler. Using those values independently as fixed min/max bases can report an incorrect configurable power range. Keep the socket power limit as the default value and as the fallback for current-limit queries. Calculate the reported range from both firmware values instead, using the lower value as the minimum base and the higher value as the maximum base before applying OD percentages. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/gmc6: replace BUG() with an errorAlex Deucher
There's no need to crash the kernel for this case. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/si: drop BUG()sAlex Deucher
There's no need to crash the kernel for these cases. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/sdma3.0: replace BUG() with an errorAlex Deucher
There's no need to crash the kernel for this case. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/sdma2.4: replace BUG() with an errorAlex Deucher
There's no need to crash the kernel for this case. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/cik_sdma: replace BUG() with an errorAlex Deucher
There's no need to crash the kernel for this case. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/ucode: WARN() rather than BUG()Alex Deucher
There's no need to crash the kernel for this case. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/cgs: WARN() rather than BUG()Alex Deucher
There's no need to crash the kernel for these cases. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/atomfirmware: WARN() rather than BUG()Alex Deucher
There's no need to crash the kernel for this case. Just return an error. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/gfx12.1: WARN() rather than BUG() for invalid SDMA engineAlex Deucher
There's no need to crash the kernel for these cases. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/gfx12: WARN() rather than BUG() for invalid SDMA engineAlex Deucher
There's no need to crash the kernel for these cases. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/gfx11: WARN() rather than BUG() for invalid SDMA engineAlex Deucher
There's no need to crash the kernel for these cases. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: return an error instead of BUG() for CSA bo_vaAlex Deucher
If the bo_va is not present, return an error rather than crashing the kernel. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/gfx11: enable gfx pipe1 hardware supportAlex Deucher
Enable gfx pipe1 hardware support. This is only available on gfx11 chips using the F32 microcontroller. Chips using the RS64 microcontroller are not able to use the second gfx pipe. In practice this means the second pipe is only available on APUs. This explains the stability issues Pierre-Eric saw previously with this on Navi33. Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/gfx12: Program DB_RING_CONTROLAlex Deucher
This is needed to allocate occlusion counters across both gfx pipes. GFX 12 only has one gfx pipe, so no functional change since the default value is 1. Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/gfx11: Program DB_RING_CONTROLAlex Deucher
This is needed to allocate occlusion counters across both gfx pipes. No functional change since we only use one gfx pipe at the moment (default value is 1). Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/gfx10: Program DB_RING_CONTROLAlex Deucher
This is needed to allocate occlusion counters across both gfx pipes. Fixes: b7a1a0ef12b8 ("drm/amd/amdgpu: add pipe1 hardware support") Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: Check bounds in allocate_event_notification_slotDavid Francis
The valid event ids go from 0 to KFD_SIGNAL_EVENT_LIMIT allocate_event_notification_slot has an option to specify an event id to allocate at, used by CRIU. We weren't checking the bounds on that value. Check them. v2: Lower bounds check is unecessary because of idr_alloc already rejecting negative numbers. Upper bounds check should be KFD_SIGNAL_EVENT_LIMIT since the signal mode mappings might not yet exist Signed-off-by: David Francis <David.Francis@amd.com> Reviewed-by: David Yat Sin <david.yatsin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08amdkfd: properly free secondary context idZhu Lingshan
Function kfd_process_free_id() should skip over the primary kfd process because its context id is fixed assigned, not allocated through the ida table. This function should only work on secondary contexts. Fixes: fac682a1d1af ("amdkfd: identify a secondary kfd process by its id") Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08audit: fix potential integer overflow in audit_log_n_hex()Ricardo Robaina
The function calculates new_len as len << 1 for hex encoding. This has two overflow risks: the shift itself can overflow when len is large, and the result can be truncated when assigned to new_len (declared as int) from the size_t calculation. Fix by using check_shl_overflow() to catch shift overflow and changing new_len and loop counter i to size_t to prevent truncation. Cc: stable@vger.kernel.org Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings") Reviewed-by: Richard Guy Briggs <rgb@redhat.com> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> [PM: remove vertical whitspace noise] Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-07-08sched_ext: Preserve rq tracking across local DSQ dispatchAndrea Righi
dispatch_to_local_dsq() can run from scx_bpf_dsq_move_to_local() while ops.dispatch() has recorded the current rq. Moving a task to a local DSQ may switch to the source or destination rq before synchronously invoking ops.dequeue() through the following path: SCX_CALL_OP(dispatch, rq) ops.dispatch() scx_bpf_dsq_move_to_local() scx_flush_dispatch_buf() finish_dispatch() dispatch_to_local_dsq() scx_dispatch_enqueue() local_dsq_post_enq() call_task_dequeue() SCX_CALL_OP_TASK(dequeue, locked_rq, ...) The nested callback saves the recorded rq and restores it on return. If the rq tracking does not follow the lock switch, update_locked_rq() can trigger the following lockdep assertion while restoring an rq which is no longer held: WARNING: kernel/sched/sched.h:1641 at call_task_dequeue+0x160/0x170 Call Trace: scx_dispatch_enqueue+0x2b0/0x460 dispatch_to_local_dsq+0x138/0x230 scx_flush_dispatch_buf+0x1af/0x220 scx_bpf_dsq_move_to_local___v2+0xe2/0x1c0 bpf__sched_ext_ops_dispatch+0x4b/0xa7 do_pick_task_scx+0x3b6/0x910 __pick_next_task+0x105/0x1f0 __schedule+0x3e7/0x1980 Introduce switch_rq_lock() to update the tracking state together with each rq lock handoff. Use it in dispatch_to_local_dsq(), move_remote_task_to_local_dsq() and the in-balance paths of scx_dsq_move(), ensuring that scx_locked_rq() consistently refers to the rq whose lock is actually held throughout the lock dance. Fixes: 7fb39e4eb4c3 ("sched_ext: Save and restore scx_locked_rq across SCX_CALL_OP") Cc: stable@vger.kernel.org # 7.1+ Signed-off-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-08drm/amdkfd: Don't acquire buffers during CRIU queue restore.David Francis
kfd_criu_restore_queue's call of kfd_queue_acquire_buffers was failing for multiple reasons - The ctl_stack_size set by the CRIU plugin doesn't match what is expected by acquire_buffers - The svm buffer cannot be acquired at this point because CRIU may not have restored it, or may have restored it to a different address. The only reason acquire_buffers was necessary here was to avoid a null ptr dereference in init_user_queue. Just put in a check for that dereference; it doesn't appear to come up in real use cases right now. That is, there is no usage of CRIU with shared MES. This is a partial revert of commit 20a5e7ffdfec ("drm/amdkfd: Properly acquire queue buffers in CRIU restore") Fixes: 20a5e7ffdfec ("drm/amdkfd: Properly acquire queue buffers in CRIU restore") Reviewed-by: David Yat Sin <david.yatsin@amd.com> Signed-off-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: Check bounds on CRIU restore queue type and mqd sizeDavid Francis
We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided type is less than it. For mqd_size, add new function mqd_size_from_queue_type and confirm that the provided mqd_size matches expectations. Reviewed-by: David Yat Sin <david.yatsin@amd.com> Signed-off-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()Shahyan Soltani
The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_irqrestore is called and returned, the pointer is no longer under lock and is subject to modification. Since, the caller still dereferences vm->task_info in amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a use after unlock problem. Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() through removing the amdgpu_vm_get_vm_from_pasid() function from amdgpu_vm.c and making the relevant code inline to hold the lock while it is still in use. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: include amdgpu_video_codecs.h only where neededShahyan Soltani
Remove #include "amdgpu_video_codecs.h" from amdgpu.h and add forward declaration of struct amdgpu_video_codecs. Add #include "amdgpu_video_codecs.h" into files amdgpu_kms.c, amdgpu_virt.c, cik.c, nv.c, si.c, soc15.c, soc21.c, soc24.c, soc_v1_0.c, and vi.c. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move amdgpu_allowed_register_entry into amdgpu_reg_access.hShahyan Soltani
Move struct amdgpu_allowed_register_entry from monolithic amdgpu.h file into existing amdgpu_reg_access.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move amdgpu_acpi helpers into new headerShahyan Soltani
Move struct amdgpu_uma_carveout_option, struct amdgpu_uma_carveout_info, struct amdgpu_numa_info, and relevant acpi helpers from the monolithic amdgpu.h header file into a new amdgpu_acpi.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amd/display: Fix sign mismatch warningGeorge Zhang
Using mismatched signedness (int and uint32_t) causes a -Wsign-compare warning. Fix it by changing the min macro to min_t to explicitly cast. Fixes: 8cbe3648aa86 ("drm/amd/display: clamp DMUB AUX reply length to payload buffer") Signed-off-by: George Zhang <george.zhang@amd.com> Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move struct amdgpu_mqd and helpers into header fileShahyan Soltani
Move struct amdgpu_mqd_prop, struct amdgpu_mqd, and helpers from the monolithic amdgpu.h into existing amdgpu_mes.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move struct amdgpu_video_codecs and helpers into header fileShahyan Soltani
Move struct amdgpu_video_codec_info, struct amdgpu_video_codecs, and helpers into a new amdgpu_video_codecs.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move struct amdgpu_wb and helpers into separate filesShahyan Soltani
Move struct amdgpu_wb and helpers out of the monolithic header amdgpu.h into its own dedicated header amdgpu_wb.h. Add amdgpu_wb_init() and amdgpu_wb_fini() into amdgpu_wb.h. Move functions amdgpu_device_wb_get(), amdgpu_device_wb_free(), amdgpu_device_wb_init(), and amdgpu_device_wb_fini() out of amdgpu_device.c into new dedicated amdgpu_wb.c file. Removed static from functions amdgpu_device_wb_init() and amdgpu_device_wb_fini(). Rename functions amdgpu_device_wb_get(), amdgpu_device_wb_free(), amdgpu_device_wb_init(), and amdgpu_device_wb_fini() into amdgpu_wb_get(), amdgpu_wb_free(), amdgpu_wb_init(), and amdgpu_wb_fini(). Update amdgpu/Makefile to build amdgpu_wb.o. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/mes12: Remove MES self testSrinivasan Shanmugam
The MES self test is no longer needed. Other MES versions already dropped their self tests since IGT now covers this functionality. Remove the MES v12 self test as well. Cc: Alex Deucher <alexander.deucher@amd.com> Suggested-by: Christian König <christian.koenig@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>