summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-05-05media: vivid: fix cleanup bugs in vivid_init()Guangshuo Li
When platform_device_register() fails in vivid_init(), the embedded struct device in vivid_pdev has already been initialized by device_initialize(), but the failure path jumps to free_output_strings without dropping the device reference for the current platform device: vivid_init() -> platform_device_register(&vivid_pdev) -> device_initialize(&vivid_pdev.dev) -> setup_pdev_dma_masks(&vivid_pdev) -> platform_device_add(&vivid_pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before jumping to the common cleanup path. Also, the unreg_driver label incorrectly calls platform_driver_register() instead of platform_driver_unregister(), which breaks cleanup when workqueue creation fails after successful driver registration. Fix that as well. The reference leak was identified by a static analysis tool I developed and confirmed by manual review. The incorrect cleanup call was found during code inspection. Fixes: f46d740fb0258 ("[media] vivid: turn this into a platform_device") Fixes: d7c969f37515d ("media: vivid: Add 'Is Connected To' menu controls") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: vimc: fix reference leak on failed device registrationGuangshuo Li
When platform_device_register() fails in vimc_init(), the embedded struct device in vimc_pdev has already been initialized by device_initialize(), but the failure path returns the error without dropping the device reference for the current platform device: vimc_init() -> platform_device_register(&vimc_pdev) -> device_initialize(&vimc_pdev.dev) -> setup_pdev_dma_masks(&vimc_pdev) -> platform_device_add(&vimc_pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before returning the error. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fixes: 4babf057c143f ("media: vimc: allocate vimc_device dynamically") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: vidtv: fix reference leak on failed device registrationGuangshuo Li
When platform_device_register() fails in vidtv_bridge_init(), the embedded struct device in vidtv_bridge_dev has already been initialized by device_initialize(), but the failure path returns the error without dropping the device reference for the current platform device: vidtv_bridge_init() -> platform_device_register(&vidtv_bridge_dev) -> device_initialize(&vidtv_bridge_dev.dev) -> setup_pdev_dma_masks(&vidtv_bridge_dev) -> platform_device_add(&vidtv_bridge_dev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before returning the error. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fixes: f90cf6079bf67 ("media: vidtv: add a bridge driver") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: dm1105: fix missing error check for dma_alloc_coherentZhaoyang Yu
The return value of dm1105_dma_map(), which handles DMA memory allocation, is ignored in dm1105_hw_init(). If dma_alloc_coherent() fails, the driver will proceed using a NULL pointer for DMA transfers, leading to a kernel oops or invalid hardware access. Fix this by checking the return value and propagating -ENOMEM on failure. Signed-off-by: Zhaoyang Yu <2426767509@qq.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05staging: media: av7110: remove dead code from av7110_hw.cJosh Hesketh
Remove functions av7110_reset_arm() and av7110_send_ci_cmd() which have both been disabled behind #if 0 since the introduction to staging. Code can be recovered from git history. Signed-off-by: Josh Hesketh <josh.hesketh@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: vpif_capture: fix OF node reference imbalanceJohan Hovold
The driver reuses the OF node of the parent device but fails to take another reference to balance the one dropped by the platform bus code when unbinding the parent and releasing the child devices. Fix this by using the intended helper for reusing OF nodes. Fixes: 4a5f8ae50b66 ("[media] davinci: vpif_capture: get subdevs from DT when available") Cc: stable@vger.kernel.org # 4.13 Cc: Kevin Hilman <khilman@baylibre.com> Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: s2255: refactor endpoint lookupJohan Hovold
Use the common USB helper for looking up bulk-in endpoints instead of open coding. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: hdpvr: refactor endpoint lookupJohan Hovold
Use the common USB helper for looking up bulk-in endpoints instead of open coding. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: gspca: refactor endpoint lookupJohan Hovold
Use the common USB helper for looking up interrupt-in endpoints instead of open coding. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: si470x-usb: refactor endpoint lookupJohan Hovold
Use the common USB helper for looking up interrupt-in endpoints instead of open coding. Signed-off-by: Johan Hovold <johan@kernel.org> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: dead code cleanup in kconfig for VIDEO_SOLO6X10Julian Braha
The same kconfig 'select FONT_8x16' appears twice for VIDEO_SOLO6X10. I propose removing the second instance, as it is effectively dead code. This dead code was found by kconfirm, a static analysis tool for Kconfig. Signed-off-by: Julian Braha <julianbraha@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: nuvoton: npcm-video: fix memory leaks in probe and removeDavid Carlier
npcm_video_probe() allocates the npcm_video structure with kzalloc_obj() but never frees it on any probe error path or in npcm_video_remove(), leaking the allocation on every failed probe and every normal unbind. Additionally, when npcm_video_setup_video() fails, the reserved memory association established by of_reserved_mem_device_init() in npcm_video_init() is not released, leaking the rmem_assigned_device entry on the global list. Fix both by adding kfree(video) to all probe error paths and to npcm_video_remove(), and adding the missing of_reserved_mem_device_release() call when npcm_video_setup_video() fails. Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine") Cc: stable@vger.kernel.org Signed-off-by: David Carlier <devnexen@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: nuvoton: npcm-video: fix error handling in npcm_video_init()David Carlier
npcm_video_init() has two error handling issues after of_reserved_mem_device_init() is called: When dma_set_mask_and_coherent() fails, the function releases the reserved memory but does not return, allowing execution to fall through into npcm_video_ece_init() with a failed DMA configuration. When npcm_video_ece_init() fails, the function returns an error without calling of_reserved_mem_device_release(), leaking the reserved memory association. Fix both by adding the missing return after the DMA mask failure and adding the missing of_reserved_mem_device_release() call on the ECE init error path. Fixes: 46c15a4ff1f4 ("media: nuvoton: Add driver for NPCM video capture and encoding engine") Cc: stable@vger.kernel.org Signed-off-by: David Carlier <devnexen@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05staging: media: av7110: fix coding styleChethan C
Fix indentation and alignment issues reported by checkpatch.pl. Rename enums av7110_rec_play_state, av7110_type_rec_play_format, and av7110_encoder_command to follow kernel naming style. Rename wssData and wssMode to wss_data and wss_mode to avoid camelCase identifiers. Signed-off-by: Chethan C <mail.chethanc@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: aspeed: fix missing of_reserved_mem_device_release() on probe failureDavid Carlier
aspeed_video_init() calls of_reserved_mem_device_init() to associate reserved memory regions with the device. When aspeed_video_setup_video() subsequently fails in aspeed_video_probe(), the error path frees the JPEG buffer and unprepares the clocks but does not release the reserved memory association, leaking the rmem_assigned_device entry on the global list. The normal remove path already calls of_reserved_mem_device_release() correctly; only the probe error path was missing it. Add the missing of_reserved_mem_device_release() call to the aspeed_video_setup_video() failure cleanup. Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver") Cc: stable@vger.kernel.org Signed-off-by: David Carlier <devnexen@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: synopsys: hdmirx: Fix HPD lane hold timeDmitry Osipenko
Increase time of holding HPD lane low by 50ms. This fixes EDID change not detected by source/display side. Fixes: 7b59b132ad43 ("media: platform: synopsys: Add support for HDMI input driver") Cc: stable@vger.kernel.org Reported-by: Ross Cawston <ross@r-sc.ca> Closes: https://lore.kernel.org/linux-rockchip/20260209061654.54757-1-ross@r-sc.ca/ Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05staging: media: av7110: remove print_time() dead codeTomasz Unger
The DEBUG_TIMING macro is commented out and can never be defined, making the print_time() function body always empty. Remove the commented-out macro, the unused function definition and all its call sites as they serve no purpose. Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05staging: media: av7110: remove dead code in av7110.cTomasz Unger
Remove commented-out line of dead code that serves no purpose. Signed-off-by: Tomasz Unger <tomasz.unger@yahoo.pl> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()Felix Gu
In vip_probe_slice(), the error check for devm_kzalloc() incorrectly uses PTR_ERR_OR_ZERO() which returns 0 for NULL pointer. Return -ENOMEM for devm_kzalloc() failure. Fixes: fc2873aa4a21 ("media: ti: vpe: Add the VIP driver") Cc: stable@vger.kernel.org Signed-off-by: Felix Gu <ustc.gu@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: ti: vpe: Fix the error code of devm_request_irq()Felix Gu
Return the actual error code from devm_request_irq() instead of incorrectly returning -ENOMEM. Fixes: fc2873aa4a21 ("media: ti: vpe: Add the VIP driver") Cc: stable@vger.kernel.org Signed-off-by: Felix Gu <ustc.gu@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: ti: vpe: Fix fwnode_handle leak in vip_probe_complete()Felix Gu
In vip_probe_complete(), the fwnode_handle reference is not released if the loop continues via the default switch case or if alloc_port() fails. This results in a reference count leak. Switch to using the __free(fwnode_handle) cleanup attribute to ensure the reference is automatically released when the handle goes out of scope. Fixes: fc2873aa4a21 ("media: ti: vpe: Add the VIP driver") Cc: stable@vger.kernel.org Signed-off-by: Felix Gu <ustc.gu@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05media: vidtv: fix NULL pointer dereference in vidtv_mux_push_siRuslan Valiyev
syzbot reported a general protection fault in vidtv_psi_ts_psi_write_into [1]. vidtv_mux_get_pid_ctx() can return NULL, but vidtv_mux_push_si() does not check for this before dereferencing the returned pointer to access the continuity counter. This leads to a general protection fault when accessing a near-NULL address. The root cause is that vidtv_mux_pid_ctx_init() does not check the return value of vidtv_mux_create_pid_ctx_once() for PMT section PIDs. If the allocation fails, the PID context is never created, but init returns success. The subsequent vidtv_mux_push_si() call then gets NULL from vidtv_mux_get_pid_ctx() and crashes. Fix both the root cause (add error check in vidtv_mux_pid_ctx_init for PMT PIDs) and add defensive NULL checks in vidtv_mux_push_si for all vidtv_mux_get_pid_ctx() calls. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: events vidtv_mux_tick RIP: 0010:vidtv_psi_ts_psi_write_into+0x54a/0xbc0 drivers/media/test-drivers/vidtv/vidtv_psi.c:197 Call Trace: <TASK> vidtv_psi_table_header_write_into drivers/media/test-drivers/vidtv/vidtv_psi.c:799 [inline] vidtv_psi_pmt_write_into+0x3b2/0xa70 drivers/media/test-drivers/vidtv/vidtv_psi.c:1231 vidtv_mux_push_si+0x932/0xe80 drivers/media/test-drivers/vidtv/vidtv_mux.c:196 vidtv_mux_tick+0xe9b/0x1480 drivers/media/test-drivers/vidtv/vidtv_mux.c:408 Fixes: f90cf6079bf67 ("media: vidtv: add a bridge driver") Cc: stable@vger.kernel.org Reported-by: syzbot+814c351d094f4f1a1b86@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=814c351d094f4f1a1b86 Signed-off-by: Ruslan Valiyev <linuxoid@gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
2026-05-05drm/exynos: remove bridge when component_add failsOsama Abdelkader
Use devm_drm_bridge_add() so the bridge is released if probe fails after registration, and drop the manual drm_bridge_remove() in remove(). Check the return value of devm_drm_bridge_add(). Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com> Fixes: 576d72fbfb45 ("drm/exynos: mic: add a bridge at probe") Cc: stable@vger.kernel.org Reviewed-by: Raphaël Gallais-Pou <rgallaispou@gmail.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260423200622.325076-2-osama.abdelkader@gmail.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-05-05firmware: arm_scmi: Convert to list_for_each_entry()Geert Uytterhoeven
Simplify the loop in scmi_handle_get() by using list_for_each_entry(). Suggested-by: Marek Vasut <marek.vasut@mailbox.org> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/bccbd4a64ef4619afd5454e9e533073b00aeaba6.1775205358.git.geert+renesas@glider.be Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_scmi: quirk: Simplify quirk table iterationGeert Uytterhoeven
The current table entry is assigned in both the init and loop expressions of the for-statement. Merge this into a single assignment in the conditional expression, to simplify the code. While at it, make the loop counter unsigned and loop-local. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/8577f4b103cf04420c3b67dcaad528daff867287.1775205358.git.geert+renesas@glider.be Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_scmi: quirk: Improve quirk range parsingGeert Uytterhoeven
When a range contains only an end ("-X"), the number string is parsed twice, as both "sep == first" and "sep != last" are true. Fix this by dropping the superfluous number parsing for "sep == first". This does have a harmless functional impact for the unbounded range: "-" is now accepted, while it was rejected before. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/fe257b3b7b7b5c17fd0e5727bb9746c731bd7e3c.1775205358.git.geert+renesas@glider.be (sudeep.holla: Initialise ret to 0 as it will be uninitialise for "-" range) Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_scmi: Rename struct scmi_revision_info to scmi_base_infoMarek Vasut
Rename struct scmi_revision_info to struct scmi_base_info , to accurately represent its content. The scmi_revision_info is no longer accurate, because the structure now contains more than only SCMI base protocol revision, it now also contains number of protocols, agents, vendor and subvendor strings. All those are fetched from the base protocol, so rename the structure to scmi_base_info, to match the other scmi_*_info structure names. No functional change. Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Link: https://patch.msgid.link/20260406155343.72087-1-marek.vasut+renesas@mailbox.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: imx: sm-misc: Print boot/shutdown reasonsPeng Fan
Add reset reason string table for i.MX95 and introduce a helper (scmi_imx_misc_get_reason) to query and print both system and LM (Logical Machine) reset reasons via the SCMI MISC protocol. Signed-off-by: Peng Fan <peng.fan@nxp.com> Link: https://patch.msgid.link/20260305-scmi-imx-reset-v1-2-18de78978ba9@nxp.com Acked-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_scmi: imx: Support getting reset reason of MISC protocolPeng Fan
MISC protocol supports getting reset reason per Logical Machine or System. Add the API for user to retrieve the information from System Manager. Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Link: https://patch.msgid.link/20260305-scmi-imx-reset-v1-1-18de78978ba9@nxp.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05clk: microchip: rename clk-core to clk-pic32Conor Dooley
clk-core is a confusingly generic name, since it is only used by a single platform and it uses very similar naming to the "soft" IP cores for use in FPGA fabric (CoreClock or similar is what that would be called, although nothing like that exists right now) that the FPGA business unit produces. Rename it to clk-pic32, matching the prefix used by most functions in the driver. As far as I can tell, impact on whatever users may (or may not...) exist for the platform is minimal as it's built-in only and the functions are called directly from clk-pic32mzda.c Reviewed-by: Brian Masney <bmasney@redhat.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-05-05drm/amdgpu: nuke amdgpu_userq_fence_slab v2Christian König
As preparation for independent fences remove the extra slab, kmalloc should do just fine. v2: use GFP_KERNEL instead of GFP_ATOMIC Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Sunil Khatri <sunil.khatri@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 0d831487b5be0ae59cac865a0aa87b0acc3dc717)
2026-05-05drm/amdgpu/userq: fix access to stale wptr mappingSunil Khatri
Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while a queue creation is in progress and passing other bo at same address. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1fc6c8ab45dbee096469c08c13f6099d57a52d6c) Cc: stable@vger.kernel.org
2026-05-05drm/amdkfd: Check if there are kfd porcesses using adev by kfd_processes_countXiaogang Chen
During gpu hot-unplug need check if there are kfd porcesses still using the being removed gpu before clean resources of the device. Current driver checks if kfd_processes_table is empty. kfd processes are not terminated after removed from kfd_processes_table immediately. They are still alive and may access the device until kfd_process_wq work queue got ran. Check kfd->kfd_processes_count value that is updated after kfd process got uninitialized when its ref becomes zero. Fixes: 6cca686dfce7 ("drm/amdkfd: kfd driver supports hot unplug/replug amdgpu devices") Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d12d05c4bc4c15585130af43e897923ff292df7b)
2026-05-05drm/amdgpu: zero-initialize GART table on allocationPhilip Yang
GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a single PTE is written the TLB may speculatively load other uninitialized entries from the same cacheline. Those garbage entries can appear valid, and a subsequent write to another PTE in the same cacheline may cause the GPU to use a stale garbage PTE from the TLB. Fix this by calling memset_io() to zero-initialize the GART table with gart_pte_flags immediately after allocation. Using AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work since SDMA needs GART to be initialized to work. Suggested-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Philip Yang <Philip.Yang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24) Cc: stable@vger.kernel.org
2026-05-05drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emissionJohn B. Moore
sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions that verify fence writeback addresses are dword-aligned. These assertions can be reached from unprivileged userspace via crafted DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a scheduler worker thread. Replace both BUG_ON() calls with WARN_ON() to log the condition without crashing the kernel. A misaligned fence address at this point indicates a driver bug, but crashing the kernel is never the correct response when the assertion is reachable from userspace. The CS IOCTL path is the correct place to filter invalid submissions; the ring emission callback is too late to do anything about it. Fixes: 2130f89ced2c ("drm/amdgpu: add SDMA v4.0 implementation (v2)") Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: John B. Moore <jbmoore61@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e) Cc: stable@vger.kernel.org
2026-05-05drm/radeon: add missing revision check for CIAlex Deucher
The memory level workarounds only apply to revision 0 SKUs. Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816 Fixes: 127e056e2a82 ("drm/radeon: fix mclk vddc configuration for cards for hawaii") Fixes: 21b8a369046f ("drm/radeon: fix dram timing for certain hawaii boards") Fixes: 90b2fee35cb9 ("drm/radeon: fix dpm mc init for certain hawaii boards") Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 4d8dcc14311515077062b5740f39f427075de5c9) Cc: stable@vger.kernel.org
2026-05-05drm/amdgpu/pm: align Hawaii mclk workaround with radeonAlex Deucher
Align the hawaii mclk workaround with radeon and windows. Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816 Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)") Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 9649528b637f668c5af9f2b83ca4ad8576ae2121) Cc: stable@vger.kernel.org
2026-05-05drm/amdgpu/pm: add missing revision check for CIAlex Deucher
The ci_populate_all_memory_levels() workaround only applies to revision 0 SKUs. Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816 Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)") Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1db15ba8f72f400bbad8ae0ce24fafc43429d4bd) Cc: stable@vger.kernel.org
2026-05-05drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQJohn B. Moore
Remove the BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT) assertion from gfx_v9_0_ring_emit_fence_kiq(). The KIQ hardware supports 64-bit fence writes; the 32-bit writeback address constraint is an upper-layer convention, not a hardware limitation. The check serves no purpose and should not be present. Found by code inspection while investigating related BUG_ON assertions in the GFX and compute ring emission paths. Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: John B. Moore <jbmoore61@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1b1101a46a426bb4328116bb5273c326a2780389) Cc: stable@vger.kernel.org
2026-05-05drm/amdkfd: Make all TLB-flushes heavy-weightFelix Kuehling
With only one sequence number we cannot track the need for legacy vs heavy-weight flushes reliably. Always use heavy-weight. Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Philip Yang <philip.yang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit c1a3ff1d327820cd9a52bc1056b98681fc088949) Cc: stable@vger.kernel.org
2026-05-05drm/panel: Enable GPIOLIB for panels which uses functions from itDavid Heidelberg
These panels used on sdm845 devices are using GPIOLIB functions, ensure it's enabled. Signed-off-by: David Heidelberg <david@ixit.cz> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260505-panel-clean-up-kconfig-dep-v2-4-9cc31d6e6919@ixit.cz
2026-05-05drm/panel: Clean up S6E3HA2 config dependencies and fill help textDavid Heidelberg
As per the config name this Display IC features a DSI command-mode interface (or the command to switch to video mode is not known/documented) and does not use any of the video-mode helper utilities, hence should not select VIDEOMODE_HELPERS. In addition it uses devm_gpiod_get() and related functions from GPIOLIB. Fixes: 779679d3c164 ("drm/panel: Add support for S6E3HA8 panel driver") Signed-off-by: David Heidelberg <david@ixit.cz> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260505-panel-clean-up-kconfig-dep-v2-3-9cc31d6e6919@ixit.cz
2026-05-05drm/panel: Clean up S6E3FC2X01 config dependenciesDavid Heidelberg
As per the config name this Display IC features a DSI command-mode interface (or the command to switch to video mode is not known/documented) and does not use any of the video-mode helper utilities, hence should not select VIDEOMODE_HELPERS. In addition it uses devm_gpiod_get() and related functions from GPIOLIB. Fixes: 88148c30ef26 ("drm/panel: Add Samsung S6E3FC2X01 DDIC with AMS641RW panel") Signed-off-by: David Heidelberg <david@ixit.cz> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260505-panel-clean-up-kconfig-dep-v2-2-9cc31d6e6919@ixit.cz
2026-05-05drm/panel: Clean up SOFEF00 config dependenciesMarijn Suijten
As per the config name this Display IC features a DSI command-mode interface (or the command to switch to video mode is not known/documented) and does not use any of the video-mode helper utilities, hence should not select VIDEOMODE_HELPERS. In addition it uses devm_gpiod_get() and related functions from GPIOLIB. Fixes: 5933baa36e26 ("drm/panel/samsung-sofef00: Add panel for OnePlus 6/T devices") Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Reviewed-by: Casey Connolly <casey.connolly@linaro.org> Reviewed-by: David Heidelberg <david@ixit.cz> Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://patch.msgid.link/20260505-panel-clean-up-kconfig-dep-v2-1-9cc31d6e6919@ixit.cz
2026-05-05drm/amdgpu: nuke amdgpu_userq_fence_slab v2Christian König
As preparation for independent fences remove the extra slab, kmalloc should do just fine. v2: use GFP_KERNEL instead of GFP_ATOMIC Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Sunil Khatri <sunil.khatri@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-05drm/amdgpu/userq: fix access to stale wptr mappingSunil Khatri
Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while a queue creation is in progress and passing other bo at same address. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-05drm/amd/display: Promote DC to 3.2.381Taimur Hassan
This version brings along following update: -add max bandwidth budget to QoS interface -Update tmz field for LSDMA -fix buffer overruns warnings -add memory bandwidth override debug interface -Find link encoder for flexible DIG mapping cases -Fix type mismatches using guards and explicit casts -Fix type mismatches in DC and DMUB modules -Skip HDR metadata update when Smart Power OLED enabled -Rename backlight_properties to pwr_backlight_properties -remove watermark range notify -Clean Up Legacy DML Content -Implement block sequencing infrastructure for modular hardware operations. -Do DML float narrowing explicit -Fix type mismatches in DML and normalize loop bounds -Remove unused state param from enable_link_analog -Fix Color Manager (3DLUT, Shaper, Blend) Acked-by: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com> Signed-off-by: James Lin <pinglei.lin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-05drm/amd/display: add max bandwidth budget to QoS interfaceWenjing Liu
[Why] The QoS reporting interface lacked a field to expose the maximum active memory bandwidth budget. Adding this field allows callers to observe the effective bandwidth ceiling. [How] Rename struct memory_qos to dc_measured_memory_qos and introduce a new struct dc_requested_memory_qos holding bandwidth lower bound, calculated average bandwidth, latency upper bounds, and max bandwidth budget. Add a get_requested_memory_qos function pointer to clk_mgr_funcs. Update dc_get_qos_info to call through the new function pointer and populate all requested QoS fields including qos_max_bw_budget_in_mbps in dc_qos_info. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: James Lin <pinglei.lin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-05drm/amd/display: Update tmz field for LSDMAAlvin Lee
[Why & How] TMZ field should be 4-bits wide instead of 1. Also add missing src/dst_cache_policy fields to tiled copy struct. Reviewed-by: Rafal Ostrowski <rafal.ostrowski@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: James Lin <pinglei.lin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-05drm/amd/display: fix buffer overruns warningsGaghik Khachatrian
[Why & How] Fixes a warning by adding bounds checks and index validation in dml2_0 sources to address static analysis warnings. Ensures safe array access and prevents out-of-bounds reads by validating indices before use, improving robustness and reliability in the affected files. Reviewed-by: Austin Zheng <austin.zheng@amd.com> Signed-off-by: Gaghik Khachatrian <gaghik.khachatrian@amd.com> Signed-off-by: James Lin <pinglei.lin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>