Linux/linux bcc44b6drivers/accel/amdxdna amdxdna_gem.c, drivers/gpu/drm/amd/amdgpu amdgpu_cs.c amdgpu_ttm.c

Merge tag 'drm-fixes-2026-08-08' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly fixes for drm, feels relatively quiet for the post-AI world,
  mostly amdgpu and xe with a few fixes across the board:

  shmem:
   - check VMA boundaries for PMD mappings

  xe:
   - Fix memory leak in exec_queue_set_hang_replay_state
   - Apply RCS/CCS yield policy to SR-IOV VFs

  amdgpu:
   - JPEG queue reset fixes
   - GC 12 fix
   - GMC 12.1 fixes
   - Lockdep false positive fix
   - Userq fix

    [45 lines not shown]
DeltaFile
+30-24drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c
+47-1drivers/gpu/drm/amd/amdgpu/gmc_v12_1.c
+26-21drivers/accel/amdxdna/amdxdna_gem.c
+13-16drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+21-6drivers/gpu/drm/bridge/parade-ps8640.c
+26-1drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+163-6919 files not shown
+298-9625 files

Linux/linux 3f00828drivers/pinctrl/qcom pinctrl-ipq9650.c pinctrl-msm.h

Merge tag 'pinctrl-v7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:
 "Qualcomm fixes: some incorrectly defined groups in IPQ9650, two pins
  needing to be marked as GPIO in IPQ806X"

* tag 'pinctrl-v7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function
  pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function
  pinctrl: qcom: ipq9650: fix audio_sec_mclk_in1/out1 group pins
DeltaFile
+4-4drivers/pinctrl/qcom/pinctrl-ipq8064.c
+5-0drivers/pinctrl/qcom/pinctrl-msm.h
+2-2drivers/pinctrl/qcom/pinctrl-ipq9650.c
+11-63 files

Linux/linux a13307ekernel/bpf verifier.c, net/ipv4 tcp_ipv4.c

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull BPF fixes from Daniel Borkmann:

 - Fix BPF verifier to preserve full pointer state for commuted
   scalar += pointer arithmetic (Yiyang Chen, Eduard Zingerman)

 - Fix a use-after-free of request sockets in the BPF TCP iterator
   batching (Jose Fernandez)

 - Fix a use-after-free of sk_redir in the BPF sockmap send verdict
   path (Chengfeng Ye)

 - Fix a netns reference imbalance in the BPF conntrack kfuncs
   (Chengfeng Ye)

 - Fix bpf_get_fsverity_digest() dynptr assumptions and silent
   digest truncation (Eric Biggers)


    [18 lines not shown]
DeltaFile
+48-24net/netfilter/nf_conntrack_bpf.c
+22-23kernel/bpf/verifier.c
+24-19net/ipv4/tcp_ipv4.c
+41-0tools/testing/selftests/bpf/progs/verifier_basic_stack.c
+30-0tools/testing/selftests/bpf/progs/dynptr_fail.c
+17-0tools/testing/selftests/bpf/progs/mem_rdonly_untrusted.c
+182-664 files not shown
+198-7610 files

Linux/linux 0150da6arch/s390/kvm pv.c kvm-s390.c, arch/x86/kvm/svm sev.c

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull vkm fixes from Paolo Bonzini:
 "s390:

   - fix a lot of small bugs and races

  x86:

   - fix missing locking related to KVM_CAP_MOVE_ENC_CONTEXT_FROM

   - warn on creating a new page table that is the child of an invalid
     one, and limit damage before it's too late

   - disable use of INVLPGA when NPT is enabled, because it doesn't seem
     to flush TLBs correctly"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (26 commits)
  KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page

    [20 lines not shown]
DeltaFile
+81-44arch/s390/kvm/kvm-s390.c
+55-19drivers/s390/cio/vfio_ccw_cp.c
+22-21arch/s390/kvm/pv.c
+35-4drivers/s390/cio/vfio_ccw_ops.c
+25-9arch/x86/kvm/svm/sev.c
+26-5drivers/s390/cio/vfio_ccw_chp.c
+244-10219 files not shown
+379-14325 files

Linux/linux 7cbe91adrivers/hwmon hwmon.c, drivers/thermal thermal_hwmon.c

Merge tag 'thermal-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull thermal control fixes from Rafael Wysocki:
 "Revert three thermal core updates, two recent ones and one older.

  The recent ones attempted to fix a design issue in the thermal core
  and simplify code on top of that, but they made changes visible to
  user space and made it unhappy.

  The older one is a misguided code cleanup that introduced a
  (potentially nasty) bug"

* tag 'thermal-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
  Revert "thermal: hwmon: Register a hwmon device for each thermal zone"
  Revert "thermal: hwmon: Use extra_groups for adding temperature attributes"
DeltaFile
+161-71drivers/thermal/thermal_hwmon.c
+2-4drivers/hwmon/hwmon.c
+1-2include/linux/hwmon.h
+164-773 files

Linux/linux 7e73882sound/soc/amd/yc acp6x-mach.c, sound/soc/codecs cs35l45-tables.c

Merge tag 'sound-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of small fixes since the last pull request. More than
  few, but an enough-manageable amount at this time.

  USB-audio:
   - UAF, OOB and such hardening fixes for USB-audio, usx2y and
     us144mkii
   - Mixer regression fixes for Logitech PRO X 2 LIGHTSPEED headset and
     M-Audio Fast Track Ultra

  HD-audio:
   - Fix for an ACPI reference leak in TAS2781 HDA side-codec

  ASoC:
   - Fixes the default tables for Cirrus Logic codecs
   - Fixes for invalid enum accesses for Qualcomm LPASS
   - Error handling and robustness fixes for Intel SOF & Soundwire

    [24 lines not shown]
DeltaFile
+33-0sound/soc/sof/ipc4-topology.c
+16-16sound/soc/codecs/cs35l45-tables.c
+28-3sound/soc/sof/intel/hda-sdw-bpt.c
+19-6sound/soc/sof/ipc4-pcm.c
+21-1sound/soc/amd/yc/acp6x-mach.c
+9-1sound/usb/fcp.c
+126-2716 files not shown
+175-4922 files

Linux/linux 5fb2107drivers/gpu/drm/amd/amdgpu jpeg_v5_3_0.c jpeg_v5_0_0.c

Merge tag 'amd-drm-fixes-7.2-2026-08-06' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-7.2-2026-08-06:

amdgpu:
- JPEG queue reset fixes
- GC 12 fix
- GMC 12.1 fixes
- Lockdep false positive fix
- Userq fix
- Bounds checking fixes
- Devcoredump fixes
- DCN 2.0.1 fix
- Aperture mapping fix
- DC avmute fix
- DC self refresh fix

radeon:
- Performance regression fix

    [5 lines not shown]
DeltaFile
+30-24drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c
+47-1drivers/gpu/drm/amd/amdgpu/gmc_v12_1.c
+13-16drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+26-1drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+17-4drivers/gpu/drm/amd/amdgpu/jpeg_v5_3_0.c
+17-4drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c
+150-5010 files not shown
+216-6416 files

Linux/linux 0f7f502drivers/accel/amdxdna amdxdna_gem.c, drivers/gpu/drm drm_gem_shmem_helper.c

Merge tag 'drm-misc-fixes-2026-08-06' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

drm-misc-fixes for v7.2-rc6:
- panthor & shmem helpers: Check vma range inside pmd fault handler.
- panthor: handle empty firmware sections correctly.
- bridge/ps8640: Forward aux transfer errors.
- amdxdna: Improve error handling in amdxdna_insert_pages.

Signed-off-by: Dave Airlie <airlied at redhat.com>

From: Maarten Lankhorst <maarten.lankhorst at linux.intel.com>
Link: https://patch.msgid.link/415659f6-5199-4078-8319-22d7529e777d@linux.intel.com
DeltaFile
+26-21drivers/accel/amdxdna/amdxdna_gem.c
+21-6drivers/gpu/drm/bridge/parade-ps8640.c
+8-1drivers/gpu/drm/v3d/v3d_sched.c
+5-1drivers/gpu/drm/panthor/panthor_gem.c
+5-1drivers/gpu/drm/drm_gem_shmem_helper.c
+6-0drivers/gpu/drm/v3d/v3d_drv.h
+71-301 files not shown
+74-307 files

Linux/linux a8934c2sound/usb quirks.c

ALSA: usb-audio: Fix sticky mixer regressions on M-Audio Fast Track Ultra

The recent fix for sticky mixer volumes caused regressions of M-audio
Fast Track Ultra device, where the mixer state is kept to the default
value.

Add the quirk entries to tolerate the broken mixer behavior.  As the
device is known to work in the implicit feedback mode, explicitly
enable the implicit feedback mode, too.

Since there are two FTU models that are almost identical, both entries
are added in this patch (0763:2080 and 0763:2081).

Fixes: 86aa1ea1f15c ("ALSA: usb-audio: Do not expose sticky mixers")
Link: https://bugzilla.suse.com/show_bug.cgi?id=1273166
Link: https://patch.msgid.link/20260807083418.1712585-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai at suse.de>
DeltaFile
+4-0sound/usb/quirks.c
+4-01 files

Linux/linux 5ec42d5arch/x86/kvm/mmu mmu.c

KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page

Explicitly clear role.invalid when deriving a child shadow page's role from
its parent to harden against bugs elsewhere in KVM, as violating KVM's
invariant that invalid pages are NOT on the list of active MMU pages leads
to use-after-free due to __kvm_mmu_prepare_zap_page() using list_add()
instead of list_move() when processing an invalid shadow page, i.e. makes a
bad situation far worse.

Yell loudly if the parent is invalid, as it means KVM has missed a validity
check, i.e. KVM is attempting to map memory using an invalid/obsolete root,
but continue on as the child is otherwise still a valid shadow page.

  ==================================================================
  BUG: KASAN: slab-use-after-free in __kvm_mmu_get_shadow_page+0x1817/0x1860 [kvm]
  Write of size 8 at addr ff11000153dd1368 by task repro/853

  CPU: 1 UID: 1000 PID: 853 Comm: repro Not tainted 7.2.0-rc2-3aec122bdcaf-next-vm #5 PREEMPT
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015

    [49 lines not shown]
DeltaFile
+3-0arch/x86/kvm/mmu/mmu.c
+3-01 files

Linux/linux f9a2394arch/arm64/mm mmu.c, mm page_table_check.c pagewalk.c

Merge tag 'mm-hotfixes-stable-2026-08-06-18-44' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull MM fixes from Andrew Morton:
 "17 hotfixes.  15 are cc:stable.  16 are for MM.

  There's a patch series from Lorenzo "mm: fix UAF caused by race
  between ptdump and vmap pgtable freeing" which addresses a quite old
  bug in the ptdump code.

  And another series also from Lorenzo which fixes a four year old bug
  in the huge_zero_folio handling.

  A series from SJ fixes a few possible divide-by-zero issues which
  Sashiko sniffed out. And a series which fixes handling of the
  commit_inputs parameters.

  The remainder are singletons, please see their changelogs for details"

* tag 'mm-hotfixes-stable-2026-08-06-18-44' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:

    [17 lines not shown]
DeltaFile
+122-77mm/huge_memory.c
+4-39arch/arm64/mm/mmu.c
+31-9mm/vmalloc.c
+21-15mm/pagewalk.c
+16-4mm/page_table_check.c
+8-5mm/damon/lru_sort.c
+202-14913 files not shown
+249-16819 files

Linux/linux 364465afs/smb/common/compress compress.h compress.c, fs/smb/server connection.c connection.h

Merge tag 'v7.2-rc6-smb3-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - Reject Pattern_V1 payloads when Pattern_V1 support was not
   negotiated

 - Validate compression transform flags and chained mode before
   allocating the decompression buffer

 - Enforce the pre-authentication PDU size limit before allocating
   the decompression buffer, preventing compressed requests from
   bypassing the limit

* tag 'v7.2-rc6-smb3-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: apply the pre-authentication PDU limit when decompressing
  ksmbd: validate compression Flags before kvmalloc
  smb: compress: reject Pattern_V1 when not negotiated
DeltaFile
+12-2fs/smb/server/compress.c
+8-3fs/smb/common/compress/compress.c
+9-0fs/smb/server/connection.h
+1-5fs/smb/server/connection.c
+2-1fs/smb/common/compress/compress.h
+32-115 files

Linux/linux e9923a6drivers/gpu/drm/xe xe_exec_queue.c xe_uc.c

Merge tag 'drm-xe-fixes-2026-08-06' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

- Fix memory leak in exec_queue_set_hang_replay_state (Michal)
- Apply RCS/CCS yield policy to SR-IOV VFs (Marcin)

Signed-off-by: Dave Airlie <airlied at redhat.com>

From: Rodrigo Vivi <rodrigo.vivi at intel.com>
Link: https://patch.msgid.link/anSESyrwICYHvZ59@intel.com
DeltaFile
+5-2drivers/gpu/drm/xe/xe_uc.c
+3-0drivers/gpu/drm/xe/xe_exec_queue.c
+8-22 files

Linux/linux 7a3c028kernel/bpf rqspinlock.c

rqspinlock: Reset tail when preserving queue on deadlock

Currently, the destruction of the waiter queue is suppressed for
rqspinlock in cases where a deadlock is detected. Deadlock checks happen
relatively frequently (on entry for AA, within 1ms for ABBA), and waiter
threads may not be involved in locking scenarios involving deadlocks.
Thus, it is useful to not flush the queue and let other waiters take a
stab at acquiring the lock after we detect a deadlock and exit.

However, we need to follow the same logic as what we did previously for
the waitq_timeout label: reset the tail, and if we cannot, signal the
next waiter appropriately. In case of deadlocks, this signal would just
mark the MCS node as unlocked, and in case of timeouts, it would signal
RES_TIMEOUT_VAL. The difference thus is in the value propagated, which
decides whether the queue remains active or gets flushed.

Not doing the tail reset, and waiting for the next waiter can lead to
cases where we are the final waiter, and thus no next waiter arrives,
leading to intermittent stalls in this path. Once the next waiter does

    [28 lines not shown]
DeltaFile
+3-2kernel/bpf/rqspinlock.c
+3-21 files

Linux/linux c0a2767fs/smb/client sess.c cifsfs.c

Merge tag 'v7.2-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - Fix potential use after free in cifs_try_adding_channels

 - Fix SMB1 large directory enumeration

 - Minor debug improvement (show compress mount option)

* tag 'v7.2-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive()
  smb: client: Fix use-after-free in cifs_try_adding_channels()
  smb/client: show compress mount option
DeltaFile
+22-6fs/smb/client/smb1transport.c
+1-1fs/smb/client/sess.c
+2-0fs/smb/client/cifsfs.c
+25-73 files

Linux/linux 6c68fa6fs/btrfs disk-io.c subpage.h, include/trace/events btrfs.h

Merge tag 'for-7.2-rc6-fixup-worker-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull Btrfs Fixes 2: Electric Boogaloo from David Sterba:
 "This brings back the fixup worker infrastructure.

  It's a mechanism to detect pages/folios that are marked dirty without
  filesystem knowledge and require COW fixup. The consequence of not
  doing so is silent data loss.

  The first patch covers the scenarios in detail, also reflecting folio
  API port and subpage block size support added in recent years. The
  original fixup worker was only for pages.

  The patch is relatively big, half of the code is debugging and support
  code, the rest is the core design around the detection and fix.

  The second patch handles an unlikely case when there's work left
  during unmount"


    [3 lines not shown]
DeltaFile
+216-1fs/btrfs/inode.c
+211-5fs/btrfs/subpage.c
+113-0fs/btrfs/extent_io.c
+36-5fs/btrfs/subpage.h
+35-0include/trace/events/btrfs.h
+27-1fs/btrfs/disk-io.c
+638-122 files not shown
+651-128 files

Linux/linux 6335463fs/btrfs Kconfig inode.c

Merge tag 'for-7.2-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:

 - fix leak in encoded ioctl write

 - disable large folios on systems with highmem

 - disable block size > page size when there's no transparent hugepage
   support (under experimental config)

 - reject compressed inline extents without valid LZO headers

 - properly initialize cached inode mapping (if block size > page size)

* tag 'for-7.2-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: initialize inode mapping flags for cached inodes
  btrfs: disable bs > ps support if no transparent hugepage support
  btrfs: fix memory leak in btrfs_do_encoded_write()

    [2 lines not shown]
DeltaFile
+10-2fs/btrfs/fs.c
+9-1fs/btrfs/disk-io.c
+3-2fs/btrfs/lzo.c
+3-1fs/btrfs/inode.c
+2-1fs/btrfs/Kconfig
+27-75 files

Linux/linux 315f4bddrivers/net/ovpn peer.c, include/net xdp_sock_drv.h

Merge tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from netfilter.

  Looks like our attempt to keep the PRs smaller have only prevented
  this one from getting even bigger. In the last 9 days there were
  405 postings explicitly tagged with [PATCH net], vs 687 with [PATCH
  net-next]. 37% of posted patches being fixes is pretty crazy, and
  that's likely undercounting because LLM "researchers" more often post
  fixes without knowing to tag the patches for specific trees. I don't
  have historic data.

  In any case, we keep adjusting the criteria. The next PR will be
  smaller.

  Current release - regressions:

   - net: defer netdev KOBJ_ADD uevent until the device is published,

    [55 lines not shown]
DeltaFile
+204-102net/netfilter/ipset/ip_set_hash_gen.h
+128-44drivers/net/ovpn/peer.c
+94-0tools/testing/selftests/net/tls.c
+66-11include/net/xdp_sock_drv.h
+74-0tools/testing/selftests/tc-testing/tc-tests/qdiscs/depth.json
+47-25net/packet/af_packet.c
+613-182121 files not shown
+1,583-590127 files

Linux/linux 8099bd0drivers/gpu/drm/amd/display/amdgpu_dm amdgpu_dm_crtc.c

drm/amd/display: allow self-refresh exit while entry is blocked

amdgpu_dm_crtc_set_static_screen_optimze() maps sso_enable to the
Replay and PSR1 vsync events. allow_sr_entry is an entry gate, but the
helper currently applies it to both directions.

A non-fast update clears allow_sr_entry. During a modeset, a separate
hardware-programming event keeps self-refresh blocked while the stream
is reprogrammed. If vblank is enabled before the entry delay expires,
the ISM calls the helper with sso_enable false. The early return drops
the disable request, so the vsync events are not set.

After enough fast commits, allow_sr_entry becomes true and the
hardware-programming event can be cleared. Since the vblank reference
remains held, there is no further zero-to-one vblank transition to
restore the missing vsync events. Replay or PSR1 can then become active
while vblank is still enabled.

Gate only requests that enable static-screen optimization. Always

    [15 lines not shown]
DeltaFile
+5-1drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c
+5-11 files

Linux/linux f9e5f51drivers/gpu/drm/amd/amdgpu amdgpu_ttm.c

drm/amdgpu: fix aperture iounmap skipped on device removal

amdgpu_pci_remove() calls drm_dev_unplug() before invoking the fini
routines. After drm_dev_unplug() the drm_dev_enter() guard in
amdgpu_ttm_fini() always returns false, so iounmap() for
aper_base_kaddr is silently skipped. On connected_to_cpu hardware
ioremap_cache() maps the aperture as WB; when iounmap() is skipped the
stale WB PAT entry persists. On reload IP discovery's
memremap(MEMREMAP_WC) on the same aperture range hits a WB/WC conflict,
producing an ioremap error and failing re-probe.

Remove the drm_dev_enter() guard and call iounmap() unconditionally.
The aperture mapping is plain MMIO and does not require device-presence
protection. Surprise-removal cleanup of aper_base_kaddr is already
handled unconditionally by amdgpu_device_unmap_mmio().

Fixes: 62d5f9f7110a ("drm/amdgpu: Unmap MMIO mappings when device is not unplugged")
Signed-off-by: Asad Kamal <asad.kamal at amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar at amd.com>

    [4 lines not shown]
DeltaFile
+2-8drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+2-81 files

Linux/linux 3141e3ddrivers/gpu/drm/amd/display/dc/hwss/dce110 dce110_hwseq.c

drm/amd/display: Check for tg ops in dce110_set_avmute

Some older DCE timing generators do not implement is_tg_enabled in
their ops table. Calling it unconditionally when waiting for AV mute
frames causes a NULL pointer dereference on Southern Islands dGPUs
when turning the display off over HDMI.

Check that tg and the required ops exist before waiting for frames.

Fixes: 414da24137ac ("drm/amd/display: Add AV mute wait frames to dce110_set_avmute")
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5557
Tested-by: Viktor Jägersküpper <viktor_jaegerskuepper at freenet.de>
Signed-off-by: Ray Wu <ray.wu at amd.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5)
Cc: stable at vger.kernel.org
DeltaFile
+4-1drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c
+4-11 files

Linux/linux b96c529drivers/gpu/drm/amd/amdgpu amdgpu_device.c amdgpu_ttm.c

Revert "drm/amdgpu: fix aperture mapping leak"

devres teardown is LIFO. The aperture devres node was registered after
the DRM device node, so devres_release_all() unmaps the aperture before
the DRM device release callback fires amdgpu_device_fini_sw(). IP
sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a
pointer derived from aper_base_kaddr, causing a kernel page fault on
probe failure / rollback:

  BUG: unable to handle page fault ... PMD 0
  RIP: vcn_v4_0_sw_fini+0x7b/0x170 [amdgpu]
  Call Trace:
    amdgpu_device_fini_sw
    amdgpu_driver_release_kms
    devm_drm_dev_init_release
    devres_release_all

This reverts commit d871e99879cb5fd1fa798b006b4888887e63a17a.


    [8 lines not shown]
DeltaFile
+19-16drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+2-0drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+21-162 files

Linux/linux 5f08eeedrivers/gpu/drm/radeon radeon_fence.c

drm/radeon: restore hardware polling in fence_is_signaled to fix performance regression

Commit 527ba26e50ec ("drm/radeon: delete radeon_fence_process in
is_signaled, no deadlock") removed the hardware polling from
radeon_fence_is_signaled() to fix a self-deadlock caused by
wake_up_all(&rdev->fence_queue) being called with the fence queue
lock held.

However, removing the polling entirely causes significant performance
regression (e.g. glxgears FPS drop) because the fence signaled check
becomes purely passive — it only reads the cached last_seq without
probing the GPU, so completed GPU work is not detected in time,
causing unnecessary CPU stalls in sync-heavy workloads.

Fix this by calling radeon_fence_activity() directly instead of
radeon_fence_process(). radeon_fence_activity() reads the hardware
fence counter and updates last_seq via atomic ops without calling
wake_up_all(), thus avoiding the deadlock while restoring timely
fence detection.

    [7 lines not shown]
DeltaFile
+7-0drivers/gpu/drm/radeon/radeon_fence.c
+7-01 files

Linux/linux ff209cddrivers/gpu/drm/amd/display/amdgpu_dm amdgpu_dm.c

drm/amd: Disable DP audio spread spectrum for Cyan Skillfish

The VBIOS for Cyan Skillfish devices (DCN201) indicates there is
DisplayPort ref clock spread spectrum downspread, so the audio clock
is corrected for it.

However, the clock source in this hardware does not seem to actually be
running with a clock downspread, so DisplayPort audio desyncs with video
after several minutes.

Ignore dprefclk SS downspread on CYAN_SKILLFISH2 asic.

Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5429
Signed-off-by: Travis K. Bangs <tbangs89 at gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(cherry picked from commit f3a2d86587432fdd9a6d401507b60a01153453c5)
Cc: stable at vger.kernel.org
DeltaFile
+5-0drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+5-01 files

Linux/linux 5227c2cdrivers/gpu/drm/amd/amdgpu gmc_v12_1.c

drm/amdgpu/gmc12.1: fix MMHUB0 check in pasid tlb flush

Check for mmhub0 rather than mmhub1.  Looks like a copy
paste typo.

Fixes: d0c989a0aad3 ("drm/amd/amdgpu : Use the MES INV_TLBS API for tlb invalidation on gfx12_1")
Cc: Shaoyun Liu <shaoyun.liu at amd.com>
Reviewed-by: Shaoyun Liu <shaoyun.liu at amd.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(cherry picked from commit 0e8faef0aaa4d08f3f4f67ee7bb74e1babc8efc4)
Cc: stable at vger.kernel.org
DeltaFile
+1-1drivers/gpu/drm/amd/amdgpu/gmc_v12_1.c
+1-11 files

Linux/linux e40ff98drivers/gpu/drm/amd/amdgpu amdgpu_dev_coredump.h amdgpu_dev_coredump.c

drm/amdgpu: Allocate coredump ring buffers per ring

Allocate each ring buffer separately. A single allocation summing all
ring sizes can exceed the page allocator's MAX_ORDER limit and fail;
per-ring buffers stay small enough to satisfy. The existing allocation
style doesn't capture any ring data if the huge allocation fails.
Splitting into multiple allocations helps to capture as much data as
possible for the core dump.

A failed ring is left with a NULL buffer and skipped when formatting.

Fixes: eea85914d15b ("drm/amdgpu: save ring content before resetting the device")
Signed-off-by: Lijo Lazar <lijo.lazar at amd.com>
Assisted-by: Claude Code
Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(cherry picked from commit 3e8e92b7892a6377bef86106bfff1b98cf586aee)
Cc: stable at vger.kernel.org
DeltaFile
+26-24drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c
+1-2drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.h
+27-262 files

Linux/linux b88a5a4drivers/gpu/drm/amd/amdgpu amdgpu_dev_coredump.c

drm/amdgpu: Use virtual alloc during coredump

The number of rings with outstanding fences can be large, requiring a
bigger allocation. Such allocations don't need to be physically
contiguous, so use kvzalloc/kvcalloc which fall back to vmalloc when
contiguous memory isn't available. This also matches the existing
kvfree used to free these allocations.

Also guard the allocation with ring_count to avoid passing 0 size to
allocation routines.

Fixes: eea85914d15b ("drm/amdgpu: save ring content before resetting the device")
Signed-off-by: Lijo Lazar <lijo.lazar at amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang at amd.com>
Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(cherry picked from commit 74d48bd6b7e12eba65de0507475b059966685ad1)
Cc: stable at vger.kernel.org
DeltaFile
+7-3drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c
+7-31 files

Linux/linux fd37f9ddrivers/gpu/drm/amd/amdgpu amdgpu_cs.c

drm/amdgpu: reject oversized IBs with per-ring packet limits

On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through
to ib->length_dw without a limit, while ring_emit_ib() encodes length
into packet fields. Oversized values can corrupt adjacent control bits
and destabilize command submission.

Add a per-ring IB packet size limit helper and reject command
submissions exceeding the corresponding dword limit before IB
allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE,
and apply the MM fallback limit for other ring types.

Signed-off-by: Candice Li <candice.li at amd.com>
Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
Signed-off-by: Alex Deucher <alexander.deucher at amd.com>
(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)
Cc: stable at vger.kernel.org
DeltaFile
+26-1drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+26-11 files

Linux/linux b77a725drivers/gpu/drm/amd/amdgpu amdgpu_userq.c

drm/amdgpu/userq: serialize queue map against GPU reset

Creating a user queue can race with a GPU reset. While recovery holds
reset_domain->sem for write, MES is unresponsive, so the ADD_QUEUE from
amdgpu_userq_map_helper() times out (-110) and an otherwise valid queue
create fails:

  amdgpu: MES(0) failed to respond to msg=ADD_QUEUE
  [drm:mes_userq_map [amdgpu]] *ERROR* Failed to map queue in HW, err (-110)
  amdgpu: [drm] *ERROR* ... Failed to map Queue
  amdgpu: [drm] *ERROR* ... Failed to create usermode queue

Take reset_domain->sem for read around the map so it runs only once MES
is back up. This mirrors amdgpu_userq_cleanup() and honors the
userq_mutex -> reset_domain->sem order; the reset path never takes
userq_mutex, so there is no deadlock.

Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang at amd.com>

    [3 lines not shown]
DeltaFile
+5-0drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+5-01 files

Linux/linux 384c1d9drivers/gpu/drm/amd/amdgpu amdgpu_lockdep.c

drm/amdgpu: Fix lockdep false positive in amdgpu_lockdep_init

Move fs_reclaim_acquire() to before all lock acquisitions to eliminate
false positive circular locking dependency warning.

This is a 7.2-cycle regression fix suitable for stable backport.

v3: Address Mikhail Gavrilov technical review:
    - Clarify that fs_reclaim_acquire/release pair only REGISTERS the
      fs_reclaim lock class, does NOT create a static edge when called
      with no locks held
    - Explain that the actual fs_reclaim -> notifier_lock edge is
      established at runtime during memory reclaim -> MMU notifier path
    - Add Cc: Arunpravin PaneerSelvam

v2: Address Mikhail Gavrilov review feedback:
    - Fix author name: Michael -> Mikhail Gavrilov in all trailers
    - Add Fixes: tag to link regression to original commit
    - Add Tested-by: Mikhail Gavrilov (tested on RX 7900 XTX)

    [16 lines not shown]
DeltaFile
+15-6drivers/gpu/drm/amd/amdgpu/amdgpu_lockdep.c
+15-61 files