Commit graph

1,447,411 commits

Author SHA1 Message Date
Christoph Hellwig
b520c4eef8 block: split bio_alloc_bioset more clearly into a fast and slowpath
bio_alloc_bioset tries non-waiting slab allocations first for the bio and
bvec array, but does so in a somewhat convoluted way.

Restructure the function so that it first open codes these slab
allocations, and then falls back to the mempools with the original
gfp mask.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> -ck
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Link: https://patch.msgid.link/20260316161144.1607877-3-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-03-17 19:27:14 -06:00
Christoph Hellwig
fed406f3c1 block: mark bvec_{alloc,free} static
Only used in bio.c these days.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> -ck
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Link: https://patch.msgid.link/20260316161144.1607877-2-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-03-17 19:27:14 -06:00
Danilo Krummrich
9aa64d2503 rust: devres: embed struct devres_node directly
Currently, the Devres<T> container uses devm_add_action() to register a
devres callback.

devm_add_action() allocates a struct action_devres, which on top of
struct devres_node, just keeps a data pointer and release function
pointer.

This is an unnecessary indirection, given that analogous to struct
devres, the Devres<T> container can just embed a struct devres_node
directly without an additional allocation.

In contrast to struct devres, we don't need to force an alignment of
ARCH_DMA_MINALIGN (as struct devres does to account for the worst case)
since we have generics in Rust. I.e. the compiler already ensures
correct alignment of the embedded T in Devres<T>.

Thus, get rid of devm_add_action() and instead embed a struct
devres_node directly.

Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260213220718.82835-6-dakr@kernel.org
[ * Improve comment about core::any::type_name(),
  * add #[must_use] to devres_node_remove(),
  * use container_of!() in devres_node_free_node().

    - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-18 00:47:14 +01:00
Qingfang Deng
bb8539e0e6 ppp: require callers of ppp_dev_name() to hold RCU
ppp_dev_name() holds the RCU read lock internally to protect pch->ppp.
However, as it returns netdev->name to the caller, the caller should
also hold either RCU or RTNL lock to prevent the netdev from being
freed.

The only two references of the function is in the L2TP driver, both of
which already hold RCU. So remove the internal RCU lock and document
that callers must hold RCU.

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260316092824.479149-1-dqfext@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17 16:18:48 -07:00
Joe Lawrence
4afc71bba8 module.lds,codetag: force 0 sh_addr for sections
Commit 1ba9f89794 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and
related macros") added .text and made .data, .bss, and .rodata sections
unconditional in the module linker script, but without an explicit
address like the other sections in the same file.

When linking modules with ld.bfd -r, sections defined without an address
inherit the location counter, resulting in non-zero sh_addr values in
the .ko.  Relocatable objects are expected to have sh_addr=0 for these
sections and these non-zero addresses confuse elfutils and have been
reported to cause segmentation faults in SystemTap [1].

Add the 0 address specifier to all sections in module.lds, including the
.codetag.* sections via MOD_SEPARATE_CODETAG_SECTIONS macro.

Link: https://sourceware.org/bugzilla/show_bug.cgi?id=33958
Fixes: 1ba9f89794 ("vmlinux.lds: Unify TEXT_MAIN, DATA_MAIN, and related macros")
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
Reviewed-by: Petr Pavlu <petr.pavlu@suse.com>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2026-03-17 23:18:02 +00:00
Kuniyuki Iwashima
e3f741f587 fou: Remove IPPROTO_UDPLITE check in gue_err() and gue6_err().
UDP-Lite has been removed, and its error handler is no
longer found in either inet_protos[IPPROTO_UDPLITE] or
inet6_protos[IPPROTO_UDPLITE].

The recursion fixed by the protocol check in gue_err()
and gue6_err() no longer occurs with UDP-Lite.

Let's remove the checks.

Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260316133127.2646421-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17 16:10:59 -07:00
Daniel Golle
05c1fc56d3 net: phy: mxl-gpy: add PHY-level statistics via ethtool
Report PCS receive error counts for all supported GPY115x, GPY2xx and
MxL862xx PHYs.

Accumulate the vendor-specific PHY_ERRCNT read-clear counter
(SEL=RXERR) in .update_stats() and expose it as both IEEE 802.3
SymbolErrorDuringCarrier and generic rx_errors via
.get_phy_stats().

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/0029a2fb29bfdcc26abff828d2e18400067b5c58.1773587924.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17 16:07:40 -07:00
Danilo Krummrich
ba424bc2c7 devres: rename and export set_node_dbginfo()
Rename set_node_dbginfo() to devres_set_node_dbginfo() and export it
through base.h, such that we can access is from the Rust devres code.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260213220718.82835-5-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-18 00:02:59 +01:00
Danilo Krummrich
b1081ef74d devres: add devres_node_remove()
When the Rust Devres<T> container type is dropped we need a way to
remove the embedded struct devres_node from the device's node list.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260213220718.82835-4-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-18 00:02:59 +01:00
Danilo Krummrich
9738ca7df9 devres: export devres_node_init() and devres_node_add()
Export devres_node_init() and devres_node_add() through base.h, such
that we can access is from the Rust devres code.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260213220718.82835-3-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-18 00:02:59 +01:00
Danilo Krummrich
31b5733bcd devres: move struct devres_node into base.h
Move struct devres_node into base.h, such that we can access it from the
Rust devres code.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260213220718.82835-2-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-18 00:02:59 +01:00
Even Xu
48e91af0cb HID: Intel-thc-hid: Intel-quickspi: Add NVL Device IDs
Add Nova Lake THC QuickSPI device IDs to support list.

Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-03-17 23:59:51 +01:00
Even Xu
d56c9cca2e HID: Intel-thc-hid: Intel-quicki2c: Add NVL Device IDs
Add Nova Lake THC QuickI2C device IDs to support list.

Signed-off-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2026-03-17 23:59:50 +01:00
Danilo Krummrich
c321a511e3 devres: remove unnecessary unlocks in devres_release_group()
There is no need to call spin_unlock_irqrestore() in every conditional
block, as release_nodes() can safely be called with an empty list, in
case we hit the "if else" or "else" case.

We do not use a scoped_guard() here to not unnecessarily change the
indentation level.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260202235210.55176-8-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-17 23:58:39 +01:00
Danilo Krummrich
e19f3fed3c devres: use guard(spinlock_irqsave) where applicable
Use guard(spinlock_irqsave)(&dev->devres_lock) where it improves the
code.

Some places still use manual spin_lock_irqsave() and spin_unlock() as
changing it to use a scoped_guard() would result in unnecessary churn.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260202235210.55176-7-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-17 23:58:39 +01:00
Danilo Krummrich
55e329d0f7 devres: add free_node callback to struct devres_node
Currently, there are three "subclasses" of struct devres_node, which are
struct devres, struct devres_group, struct devres_action.

release_nodes(), which only knows about the base struct devres_node,
assumes that for all "subclasses" struct devres_node is the first member
in the structure and calls kfree() on struct devres_node.

While this technically works, we can still improve semantical
correctness and type safety with a corresponding free_node() callback.

Additionally, we will need this callback soon in the Rust Devres code,
to allocate and free the required memory on the Rust side.

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260202235210.55176-6-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-17 23:58:39 +01:00
Danilo Krummrich
2b5c6a14b5 devres: don't require ARCH_DMA_MINALIGN for devres actions
Currently, devres actions are allocated with devres_alloc(), which
allocates a struct devres with a flexible array member for the actual
data of the resource. The flexible array member is aligned to
ARCH_DMA_MINALIGN, which is wasteful for devres actions that only need
to store a struct action_devres.

Introduce struct devres_action to handle devres actions separately from
struct devres, analogous to what we do for struct devres_group.

Speaking of which, without this patch struct devres_group is treated as
struct devres in release_nodes(). While this is not an actual bug, as
release callbacks for devres nodes in struct devres_group are empty
functions anyways, it is a bit messy and can be confusing.

(Note that besides devres actions, the Rust devres code will also make
use of this. The Rust compiler can figure out the correct alignment of T
in Devres<T> itself, i.e. no need to force a minimum alignment.)

Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260202235210.55176-5-dakr@kernel.org
[ Add missing node->release check in devres_for_each_res() and
  find_dr(); use kzalloc_obj(). - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-03-17 23:58:35 +01:00
Junrui Luo
64dcbde7f8 bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler
The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in
bnxt_async_event_process() uses a firmware-supplied 'type' field
directly as an index into bp->bs_trace[] without bounds validation.

The 'type' field is a 16-bit value extracted from DMA-mapped completion
ring memory that the NIC writes directly to host RAM. A malicious or
compromised NIC can supply any value from 0 to 65535, causing an
out-of-bounds access into kernel heap memory.

The bnxt_bs_trace_check_wrap() call then dereferences bs_trace->magic_byte
and writes to bs_trace->last_offset and bs_trace->wrapped, leading to
kernel memory corruption or a crash.

Fix by adding a bounds check and defining BNXT_TRACE_MAX as
DBG_LOG_BUFFER_FLUSH_REQ_TYPE_ERR_QPC_TRACE + 1 to cover all currently
defined firmware trace types (0x0 through 0xc).

Fixes: 84fcd9449f ("bnxt_en: Manage the FW trace context memory")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://patch.msgid.link/SYBPR01MB7881A253A1C9775D277F30E9AF42A@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-03-17 15:57:57 -07:00
Eric Biggers
7a60fe48af ima: remove buggy support for asynchronous hashes
IMA computes hashes using the crypto_shash or crypto_ahash API.  The
latter is used only when ima.ahash_minsize is set on the command line,
and its purpose is ostensibly to make the hash computation faster.

However, going off the CPU to a crypto engine and back again is actually
quite slow, especially compared with the acceleration that is built into
modern CPUs and the kernel now enables by default for most algorithms.
Typical performance results for SHA-256 on a modern platform can be
found at https://lore.kernel.org/linux-crypto/20250615184638.GA1480@sol/

Partly for this reason, several other kernel subsystems have already
dropped support for the crypto_ahash API.

The other problem with crypto_ahash is that bugs are also common, not
just in the underlying drivers, but also in the code using it, since it
is very difficult to use correctly.  Just from a quick review, here are
some of the bugs I noticed in IMA's ahash code:

- [Use after free] ima_alloc_atfm() isn't thread-safe and can trigger a
  use-after-free if multiple threads try to initialize the global
  ima_ahash_tfm at the same time.

- [Deadlock] If only one buffer is allocated and there is an error
  reading from the file, then ahash_wait() is executed twice, causing a
  deadlock in wait_for_completion().

- [Crash or incorrect hash computed] calc_buffer_ahash_atfm() is
  sometimes passed stack buffers which can be vmalloc addresses, but it
  puts them in a scatterlist assuming they are linear addresses.  This
  causes the hashing to be done on the wrong physical address.

- [Truncation to 32-bit length] ima_alloc_pages() incorrectly assumes an
  loff_t value fits in an unsigned long.  calc_buffer_ahash_atfm()
  incorrectly assumes that a loff_t value fits in an unsigned int.

So, not exactly a great track record so far, even disregarding driver
bugs which are an even larger problem.  Fortunately, in practice it's
unlikely that many users are actually setting the ima.ahash_minsize
kernel command-line parameter which enables this code.  However, given
that this code is almost certainly no longer useful (if it ever was),
let's just remove it instead of attempting to fix all these issues.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Acked-by: Dmitry Kasatkin <dmitry.kasatkin@gmail.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2026-03-17 18:53:49 -04:00
Viacheslav Dubeyko
b099ed598c hfsplus: fix to update ctime after rename
[BUG]
$ sudo ./check generic/003
FSTYP         -- hfsplus
PLATFORM      -- Linux/x86_64 graphic 6.8.0-58-generic #60~22.04.1-Ubuntu
MKFS_OPTIONS  -- /dev/loop29
MOUNT_OPTIONS -- /dev/loop29 /mnt/scratch

generic/003       - output mismatch
    --- tests/generic/003.out   2025-04-27 08:49:39.876945323 -0600
    +++ /home/graphic/fs/xfstests-dev/results//generic/003.out.bad

     QA output created by 003
    +ERROR: change time has not been updated after changing file1
     Silence is golden
    ...

Ran: generic/003
Failures: generic/003
Failed 1 of 1 tests

[CAUSE]
change time has not been updated after changing file1

[FIX]
Update file ctime after rename in hfsplus_rename().

Signed-off-by: Yangtao Li <frank.li@vivo.com>
Tested-by: Viacheslav Dubeyko <slava@dubeyko.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/linux-fsdevel/20250530081719.2430291-1-frank.li@vivo.com/
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2026-03-17 15:42:19 -07:00
Sanman Pradhan
32f59301b9 hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value
ina233_read_word_data() uses the return value of pmbus_read_word_data()
directly in a DIV_ROUND_CLOSEST() computation without first checking for
errors. If the underlying I2C transaction fails, a negative error code is
used in the arithmetic, producing a garbage sensor value instead of
propagating the error.

Add the missing error check before using the return value.

Fixes: b64b6cb163 ("hwmon: Add driver for TI INA233 Current and Power Monitor")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260317174553.385567-1-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-03-17 15:21:36 -07:00
Sanman Pradhan
c6f45ed26b hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value
In mp2869_read_byte_data() and mp2869_read_word_data(), the return value
of pmbus_read_byte_data() for PMBUS_STATUS_MFR_SPECIFIC is used directly
inside FIELD_GET() macro arguments without error checking. If the I2C
transaction fails, a negative error code is passed to FIELD_GET() and
FIELD_PREP(), silently corrupting the status register bits being
constructed.

Extract the nested pmbus_read_byte_data() calls into a separate variable
and check for errors before use. This also eliminates a redundant duplicate
read of the same register in the PMBUS_STATUS_TEMPERATURE case.

Fixes: a3a2923aaf ("hwmon: add MP2869,MP29608,MP29612 and MP29816 series driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260317173308.382545-4-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-03-17 15:20:55 -07:00
Sanman Pradhan
19d4b9c8a1 hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value
mp2973_read_word_data() XORs the return value of pmbus_read_word_data()
with PB_STATUS_POWER_GOOD_N without first checking for errors. If the I2C
transaction fails, a negative error code is XORed with the constant,
producing a corrupted value that is returned as valid status data instead
of propagating the error.

Add the missing error check before modifying the return value.

Fixes: acda945afb ("hwmon: (pmbus/mp2975) Fix PGOOD in READ_STATUS_WORD")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260317173308.382545-3-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-03-17 15:20:24 -07:00
Linus Torvalds
a989fde763 libnvdimm fixes for 7.0-rc5
- Fix old potential use after free bug
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQSgX9xt+GwmrJEQ+euebuN7TNx1MQUCabm2ZhQcaXJhLndlaW55
 QGludGVsLmNvbQAKCRCebuN7TNx1MbsiAP0T+AEoE+gMWX5dKVVJTS9tOaiEhWb/
 bOqY4kRB/tAxDgEA/LRdZTgOOY/w+JbVpQSZOvDG3BwNjM3wgEP9Ue/uuA0=
 =C+qH
 -----END PGP SIGNATURE-----

Merge tag 'libnvdimm-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

Pull libnvdimm fix from Ira Weiny:

 - Fix old potential use after free bug

* tag 'libnvdimm-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
  nvdimm/bus: Fix potential use after free in asynchronous initialization
2026-03-17 15:19:58 -07:00
Sanman Pradhan
c925fccc4f hwmon: (pmbus/hac300s) Add error check for pmbus_read_word_data() return value
hac300s_read_word_data() passes the return value of pmbus_read_word_data()
directly to FIELD_GET() without checking for errors. If the I2C transaction
fails, a negative error code is sign-extended and passed to FIELD_GET(),
which silently produces garbage data instead of propagating the error.

Add the missing error check before using the return value in
the FIELD_GET() macro.

Fixes: 669cf162f7 ("hwmon: Add support for HiTRON HAC300S PSU")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Link: https://lore.kernel.org/r/20260317173308.382545-2-sanman.pradhan@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-03-17 15:19:45 -07:00
Ashutosh Dixit
4ff57c5e8d drm/xe/oa: Allow reading after disabling OA stream
Some OA data might be present in the OA buffer when OA stream is
disabled. Allow UMD's to retrieve this data, so that all data till the
point when OA stream is disabled can be retrieved.

v2: Update tail pointer after disable (Umesh)

Fixes: efb315d0a0 ("drm/xe/oa/uapi: Read file_operation")
Cc: stable@vger.kernel.org
Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Reviewed-by: Umesh Nerlige Ramappa<umesh.nerlige.ramappa@intel.com>
Link: https://patch.msgid.link/20260313053630.3176100-1-ashutosh.dixit@intel.com
2026-03-17 15:05:29 -07:00
Alex Deucher
86650ee224 drm/radeon: apply state adjust rules to some additional HAINAN vairants
They need a similar workaround.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 87327658c8)
Cc: stable@vger.kernel.org
2026-03-17 18:04:15 -04:00
Alex Deucher
9787f7da18 drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
They need a similar workaround.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 0de31d92a1)
Cc: stable@vger.kernel.org
2026-03-17 18:04:03 -04:00
Alex Deucher
e9f58ff991 drm/amdgpu: rework how we handle TLB fences
Add a new VM flag to indicate whether or not we need
a TLB fence.  Userqs (KFD or KGD) require a TLB fence.
A TLB fence is not strictly required for kernel queues,
but it shouldn't hurt.  That said, enabling this
unconditionally should be fine, but it seems to tickle
some issues in KIQ/MES.  Only enable them for KFD,
or when KGD userq queues are enabled (currently via module
parameter).

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4798
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4749
Fixes: f3854e04b7 ("drm/amdgpu: attach tlb fence to the PTs update")
Cc: Christian König <christian.koenig@amd.com>
Cc: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Prike Liang <Prike.Liang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 69c5fbd2b9)
Cc: stable@vger.kernel.org
2026-03-17 18:03:09 -04:00
Linus Torvalds
9e22d8e18f linux_kselftest-kunit-fixes-7.0-rc5
- Adds documentation for --list_suites feature
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmm4jcoACgkQCwJExA0N
 QxxUmg//RlkCm1k7A8QVZFslvtSAgFzsMf1NHB784BO6ULFzItP/VFrL196mXv8+
 mLHn4Difet8qbqHOO8snkv7D2+tioPRsutlalOAxhTmA/hmrnfzp85DO0ZRZy1Mt
 V9x9wDXXRB7c9NHcasCvVNIuglr3PdTtML/qR/NND6zPZ+YsDy+5RfWO91TLSurs
 T53BRYGxOHbszPLHPXLV/yqctP959zKz8xfbCaBS14uHA2vQhIcyF/3gcZ5C/x6q
 FfkUmLKxnN/Sj/9bwmN2U4Uj7c5GEf7ohQS/FSn/wEPtG8cvt1anqG7nJiArc2wi
 9inS1u+SLt2dvBi6xWqkpMwTYb9Ww8Xw52tjeci0UXdVo76jF4ahdznAA7jI3wMs
 F8D9Hg38/2lQXxTUSiIHdkrRs7kqsD6XSfBY5lI3QJxTR/COZz+uVOPgCVCpXhlS
 ZBIDUuQeDq/LZTO67CAXK2cMQaLgVmlMWPFGk6DhdPU5meAUci5gaBFsM3zs9ULl
 Vgp0hCyBwuQT9etm+AHKoQSlVW6ddJTg5PQiS3xu/Y0kelW4fD4vSGDrrAi/Tnew
 1yFgHKmEANnMhhWl9q5VTLY5CypMHlJab0M2hacrW1LILksLgR0qJiOKHd8i+ZNS
 ni+9uxw9HfH2qgz0w3RNFwEL1+ZL0ZzNEWAOEJdJA7o5LySIhaE=
 =oRUA
 -----END PGP SIGNATURE-----

Merge tag 'linux_kselftest-kunit-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull kunit fix from Shuah Khan:

 - Add documentation for --list_suites feature

* tag 'linux_kselftest-kunit-fixes-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  kunit: Add documentation of --list_suites
2026-03-17 15:00:53 -07:00
Lijo Lazar
daf9f9dd50 drm/amdgpu: Add client ids for gmcv9 mmhubs
Initialize client ids for gmcv9 mmhubs

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:50:52 -04:00
Lijo Lazar
35362833df drm/amdgpu: Add client ids for mmhub v2.x
Initialize client ids for mmhub v2.x

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:50:50 -04:00
Lijo Lazar
642fb9e14c drm/amdgpu: Add client ids for mmhub v3.x
Initialize client ids for mmhub v3.x

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:50:48 -04:00
Lijo Lazar
f2eceeef68 drm/amdgpu: Add client ids for mmhub v4.x
Initialize client ids for mmhub v4.x

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:50:45 -04:00
Lijo Lazar
3baa07dcfa drm/amdgpu: Add client id helpers to mmhub
Add data structure and helpers to get client id data of mmhub.

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:50:38 -04:00
Harry Wentland
6e9d61769b Revert "drm/amd/display: Add NV12/P010 formats to primary plane"
With this change we're adding NV12 and P010 twice to reported
formats on a primary plane, which causes us to hit an assert
in Weston.

This reverts commit 63fff55131.

Fixes: 63fff55131 ("drm/amd/display: Add NV12/P010 formats to primary plane")
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:48:34 -04:00
Srinivasan Shanmugam
4fce3dfab5 drm/amdgpu: Remove dead negative offset check in amdgpu_virt_init_critical_region()
amdgpu_virt_init_critical_region() stores init_hdr_offset as u64.
The subsequent check for init_hdr_offset < 0 is therefore always false.

Drop the unreachable validation and rely on the existing
check_add_overflow() and VRAM end bounds check for offset validation.

This resolves the Smatch warning about comparing an unsigned value
against zero.

drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c:953 amdgpu_virt_init_critical_region() warn: unsigned 'init_hdr_offset' is never less than zero.

Fixes: 07009df649 ("drm/amdgpu: Introduce SRIOV critical regions v2 during VF init")
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Ellen Pan <yunru.pan@amd.com>
Cc: Lijo Lazar <lijo.lazar@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Bokun Zhang <bokun.zhang@amd.com>
Reviewed-by: Ellen Pan <yunru.pan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:47:59 -04:00
Srinivasan Shanmugam
a1c1c77d30 drm/amdgpu: Move amdgpu_vm_is_bo_always_valid() before first use
Smatch reports that 'bo' could be NULL in amdgpu_vm_bo_update(), even
though amdgpu_vm_is_bo_always_valid() already checks for a NULL BO.

Move amdgpu_vm_is_bo_always_valid() earlier in the file so the helper
definition appears before its first use. This allows static analysis
tools to see the NULL check performed by the helper and avoids the
warning.

Suggested-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:47:47 -04:00
Srinivasan Shanmugam
9a62a097a7 drm/amdgpu: Drop redundant queue NULL check in hang detect worker
amdgpu_userq_hang_detect_work() retrieves the queue pointer using
container_of() from the embedded work item.

Since the work structure is part of struct amdgpu_usermode_queue,
the returned queue pointer cannot be NULL in normal execution.

Remove the redundant !queue check and keep the validation for
queue->userq_mgr.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c:159 amdgpu_userq_hang_detect_work() warn: can 'queue' even be NULL?

Fixes: 290f46cf57 ("drm/amdgpu: Implement user queue reset functionality")
Cc: Jesse Zhang <Jesse.Zhang@amd.com>
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Acked-by: Jesse Zhang <jesse.zhang@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:46:44 -04:00
Mangesh Gadre
a53676efc4 drm/amdgpu : Update psp 13_0_15 ip block support
Included psp_13_0_15 ip block for RAS

Signed-off-by: Mangesh Gadre <Mangesh.Gadre@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:46:41 -04:00
Christian König
a1371d9f0e drm/amdgpu: rework amdgpu_userq_wait_ioctl v4
Lockdep was complaining about a number of issues here. Especially lock
inversion between syncobj, dma_resv and copying things into userspace.

Rework the functionality. Split it up into multiple functions,
consistenly use memdup_array_user(), fix the lock inversions and a few
more bugs in error handling.

v2: drop the dma_fence leak fix, turned out that was actually correct,
    just not well documented. Apply some more cleanup suggestion from
    Tvrtko.
v3: rebase on already done cleanups
v4: add missing dma_fence_put() in error path.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Sunil Khatri <sunil.khatri@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:46:30 -04:00
Christian König
2c192b06f1 drm/amdgpu: fix adding eviction fence
We can't add the eviction fence without validating the BO.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Sunil Khatri <sunil.khatri@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:46:26 -04:00
Christian König
99f30a0607 drm/amdgpu: fix eviction fence and userq manager shutdown
That is a really complicated dance and wasn't implemented fully correct.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Sunil Khatri <sunil.khatri@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:46:21 -04:00
Christian König
2cd7284ba5 drm/amdgpu: completely rework eviction fence handling v2
Well that was broken on multiple levels.

First of all a lot of checks were placed at incorrect locations, especially if
the resume worker should run or not.

Then a bunch of code was just mid-layering because of incorrect assignment who
should do what.

And finally comments explaining what happens instead of why.

Just re-write it from scratch, that should at least fix some of the hangs we
are seeing.

Use RCU for the eviction fence pointer in the manager, the spinlock usage was
mostly incorrect as well. Then finally remove all the nonsense checks and
actually add them in the correct locations.

v2: some typo fixes and cleanups suggested by Sunil

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Sunil Khatri <sunil.khatri@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:46:13 -04:00
Alex Deucher
87327658c8 drm/radeon: apply state adjust rules to some additional HAINAN vairants
They need a similar workaround.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:44:10 -04:00
Alex Deucher
0de31d92a1 drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
They need a similar workaround.

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/1839
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:44:03 -04:00
Alex Deucher
69c5fbd2b9 drm/amdgpu: rework how we handle TLB fences
Add a new VM flag to indicate whether or not we need
a TLB fence.  Userqs (KFD or KGD) require a TLB fence.
A TLB fence is not strictly required for kernel queues,
but it shouldn't hurt.  That said, enabling this
unconditionally should be fine, but it seems to tickle
some issues in KIQ/MES.  Only enable them for KFD,
or when KGD userq queues are enabled (currently via module
parameter).

Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4798
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4749
Fixes: f3854e04b7 ("drm/amdgpu: attach tlb fence to the PTs update")
Cc: Christian König <christian.koenig@amd.com>
Cc: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Prike Liang <Prike.Liang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:43:17 -04:00
Sonny Jiang
855e3e19f6 drm/amdgpu: Add JPEG_v5_0_2 IP block
Add support for JPEG_5_0_2

v2: comment out RAS for now (Alex)
v3: drop some bringup leftovers (Alex)

Signed-off-by: Sonny Jiang <sonjiang@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:43:12 -04:00
Sonny Jiang
3663c6e4a3 drm/amdgpu: Set VCN_5_0_2 DPG mode
Set DPG flag for VCN_5_0_2

Signed-off-by: Sonny Jiang <sonjiang@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:43:09 -04:00
Sonny Jiang
2eb660e626 drm/amdgpu: Add VCN_5_0_2 codecs capabilities support
Support VCN_5_0_2 codec query

Signed-off-by: Sonny Jiang <sonjiang@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-03-17 17:43:05 -04:00