Claude review: None

Claude review: None

[Claude Code Review Bot]

Overall Series Review

Subject: None
Author: None
Patches: 0
Reviewed: 2026-02-12T13:48:40.869184

---

This patch series adds support for batch userptr allocation in the AMD KFD (Kernel Fusion Driver), allowing multiple non-contiguous CPU virtual address ranges to be mapped to a single contiguous GPU virtual address. The series introduces a new UAPI flag and data structures, implements interval tree-based range tracking, MMU notifier support, and integrates the functionality into the existing ioctl interface.

**Architecture Overview:**
The implementation uses a single MMU interval notifier covering the entire VA span (min to max address across all ranges), with an interval tree for efficient lookup of affected ranges during invalidation callbacks. Each range maintains its own HMM range and validity tracking.

**Key Concerns Identified:**

1. **Memory Leak Risk (CRITICAL)**: Patch 6 has a cleanup path that fails to free `mem->user_ranges` on several error paths after allocation.

2. **Race Condition**: Patch 5 (MMU notifier callback) increments `mem->invalid` without holding `mem->lock`, while other code paths hold this lock when accessing the field.

3. **Incomplete Error Handling**: Patch 6 continues execution after TTM validation failure instead of jumping to cleanup.

4. **Resource Management Issues**: Several cleanup paths don't properly handle partially initialized state.

5. **UAPI Design Concern**: Using bit 22 for the flag is safe but leaves a small window of available flag bits in the high region.

**Positive Aspects:**
- Good patch organization with logical separation of concerns
- Comprehensive integration with existing eviction/restore infrastructure
- Proper use of kernel interval tree API
- Reasonable test coverage described

---

---
Generated by Claude Code Patch Reviewer

Claude review: None

[Claude Code Review Bot]

Overall Series Review

Subject: None
Author: None
Patches: 0
Reviewed: 2026-02-12T17:08:27.857739

---

This 8-patch series adds support for batch allocation of multiple non-contiguous userptr ranges through the AMD KFD (Kernel Fusion Driver) interface. The implementation uses a single MMU notifier spanning the entire VA range with an interval tree to efficiently track which specific ranges are invalidated.

**Architecture Overview:**
The series extends the existing userptr allocation mechanism to handle multiple CPU VA ranges that map to a single contiguous GPU VA. The key design choice is using one `mmu_interval_notifier` covering [va_min, va_max] with an interval tree to filter invalidation events.

**Major Concerns:**

1. **UAPI Stability** - Patch 1 adds new UAPI structures without incrementing KFD_IOCTL_MINOR_VERSION
2. **Memory Safety** - Several error paths lack proper cleanup
3. **Locking Issues** - Complex interaction between multiple locks with potential for deadlocks
4. **Resource Leaks** - Interval tree nodes not always removed on error paths
5. **Data Structure Initialization** - Missing initialization of critical fields in error scenarios

**Series Strengths:**
- Well-structured patch split for review
- Handles complex MMU notifier scenarios
- Interval tree usage is appropriate for the problem

---

---
Generated by Claude Code Patch Reviewer

Claude review: None

[Claude Code Review Bot]

Overall Series Review

Subject: None
Author: None
Patches: 0
Reviewed: 2026-02-13T07:38:34.124137

---

This patch series adds support for batch userptr allocation to the AMDKFD driver, allowing multiple non-contiguous CPU virtual address ranges to be mapped to a single contiguous GPU virtual address. The implementation extends the existing AMDKFD_IOC_ALLOC_MEMORY_OF_GPU ioctl with a new flag (KFD_IOC_ALLOC_MEM_FLAGS_USERPTR_BATCH) and reuses the mmap_offset field to pass a pointer to an array of range descriptors.

The series takes a reasonable architectural approach by using a single MMU notifier covering the entire VA span and an interval tree to efficiently filter affected ranges during invalidation callbacks. The implementation integrates with existing userptr validation and eviction infrastructure.

However, there are several significant correctness issues that must be addressed:

1. **Critical resource leak on error paths**: Patch 6 has a severe bug where interval tree nodes are inserted but never removed on error paths, and the MMU notifier is not unregistered in all failure scenarios.

2. **Incorrect error path flow**: The error handling in init_user_pages_batch unconditionally falls through to release_pages even on success, and has goto targets that execute cleanup for resources that haven't been fully initialized.

3. **Interval tree cleanup race**: Patch 7's cleanup_userptr_resources removes interval tree nodes without holding any lock, creating a potential race with concurrent invalidation callbacks.

4. **Missing UAPI structure padding**: The new UAPI structures lack explicit padding, which could cause alignment issues on some architectures.

5. **Incomplete kgd_mem initialization**: The batch allocation path in patch 6 doesn't initialize user_ranges_itree before inserting nodes into it in one error scenario.

These issues are detailed in the per-patch reviews below.

---
Generated by Claude Code Patch Reviewer

Claude review: None

[Claude Code Review Bot]

Overall Series Review

Subject: None
Author: None
Patches: 0
Reviewed: 2026-02-13T14:37:58.562243

---

This patch series adds support for batch userptr allocation in AMDKFD, allowing user-space to register multiple non-contiguous CPU virtual address ranges that map to a single contiguous GPU virtual address in one ioctl call. The series takes a measured approach by reusing the existing AMDKFD_IOC_ALLOC_MEMORY_OF_GPU ioctl with a new flag rather than introducing a new ioctl, minimizing the API surface change.

The architectural approach uses a single MMU interval notifier covering the span from the minimum to maximum address across all ranges, with an interval tree to efficiently filter which specific ranges are affected during invalidation callbacks. Individual ranges are tracked via the user_range_info structure which includes HMM ranges, validity flags, and interval tree nodes. The eviction/restore paths are unified to handle both single and batch allocations.

Several issues were identified that need to be addressed:

**Critical Issues:**
1. PATCH 6: In init_user_pages_batch, if get_user_pages_batch_locked fails for range i > 0, the error path doesn't properly release HMM ranges for ranges [0, i-1] that were successfully obtained. The err_cleanup_ranges path just sets range pointers to NULL without calling amdgpu_ttm_tt_get_user_pages_done.

2. PATCH 7: cleanup_userptr_resources doesn't set mem->range = NULL after calling amdgpu_ttm_tt_discard_user_pages in the single userptr cleanup path, creating a potential use-after-free if the range pointer is accessed after cleanup.

**Design Concerns:**
1. PATCH 8: kfd_copy_userptr_ranges doesn't validate an upper bound on num_ranges, allowing a user to request allocation of excessive kernel memory (though kvmalloc will eventually fail, there should be a reasonable limit like 4096 ranges).

2. PATCH 6: The initialization order in init_user_pages_batch registers the MMU notifier before obtaining pages for the ranges, creating a window where invalidation callbacks can race with initialization. While the current code handles this (valid flags start as false), this is a fragile pattern.

Overall, the series demonstrates good understanding of the HMM and MMU notifier subsystems, but the error handling needs strengthening to prevent resource leaks.

---
Generated by Claude Code Patch Reviewer

[PATCH v1 0/5] drm/panel: r61307/r69328: minor updates

[Svyatoslav Ryhel]

Align r61307 with schema property and update r61307/r69328 according
to latest DRM changes.

Svyatoslav Ryhel (5):
  drm/panel: r61307: align with schema property
  drm/panel: r61307/r69328: convert to
    drm_connector_helper_get_modes_fixed
  drm/panel: r61307/r69328: remove redundant checks
  drm/panel: r61307/r69328: return accumulated errors
  drm/panel: r61307/r69328: convert to devm_mipi_dsi_attach

 drivers/gpu/drm/panel/Kconfig                |  2 +
 drivers/gpu/drm/panel/panel-renesas-r61307.c | 40 ++++----------------
 drivers/gpu/drm/panel/panel-renesas-r69328.c | 38 +++----------------
 3 files changed, 15 insertions(+), 65 deletions(-)

-- 
2.51.0

[PATCH v1 1/5] drm/panel: r61307: align with schema property

[Svyatoslav Ryhel]

Rename renesas,inversion to renesas,column-inversion according to schema.

Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
 drivers/gpu/drm/panel/panel-renesas-r61307.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panel/panel-renesas-r61307.c b/drivers/gpu/drm/panel/panel-renesas-r61307.c
index 319415194839..873ef856184b 100644
--- a/drivers/gpu/drm/panel/panel-renesas-r61307.c
+++ b/drivers/gpu/drm/panel/panel-renesas-r61307.c
@@ -259,7 +259,7 @@ static int renesas_r61307_probe(struct mipi_dsi_device *dsi)
 		return dev_err_probe(dev, PTR_ERR(priv->reset_gpio),
 				     "Failed to get reset gpios\n");
 
-	if (device_property_read_bool(dev, "renesas,inversion"))
+	if (device_property_read_bool(dev, "renesas,column-inversion"))
 		priv->inversion = true;
 
 	if (device_property_read_bool(dev, "renesas,contrast"))
-- 
2.51.0

[PATCH v1 2/5] drm/panel: r61307/r69328: convert to drm_connector_helper_get_modes_fixed

[Svyatoslav Ryhel]

Switch to use of drm_connector_helper_get_modes_fixed helper for get_modes
operation.

Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
 drivers/gpu/drm/panel/Kconfig                |  2 ++
 drivers/gpu/drm/panel/panel-renesas-r61307.c | 17 +++--------------
 drivers/gpu/drm/panel/panel-renesas-r69328.c | 17 +++--------------
 3 files changed, 8 insertions(+), 28 deletions(-)

diff --git a/drivers/gpu/drm/panel/Kconfig b/drivers/gpu/drm/panel/Kconfig
index 477c54c90b01..47de5f6a9143 100644
--- a/drivers/gpu/drm/panel/Kconfig
+++ b/drivers/gpu/drm/panel/Kconfig
@@ -700,6 +700,7 @@ config DRM_PANEL_RENESAS_R61307
 	depends on OF
 	depends on DRM_MIPI_DSI
 	depends on BACKLIGHT_CLASS_DEVICE
+	select VIDEOMODE_HELPERS
 	help
 	  Say Y here if you want to enable support for KOE tx13d100vm0eaa
 	  IPS-LCD module with Renesas R69328 IC. The panel has a 1024x768
@@ -713,6 +714,7 @@ config DRM_PANEL_RENESAS_R69328
 	depends on OF
 	depends on DRM_MIPI_DSI
 	depends on BACKLIGHT_CLASS_DEVICE
+	select VIDEOMODE_HELPERS
 	help
 	  Say Y here if you want to enable support for JDI dx12d100vm0eaa
 	  IPS-LCD module with Renesas R69328 IC. The panel has a 720x1280
diff --git a/drivers/gpu/drm/panel/panel-renesas-r61307.c b/drivers/gpu/drm/panel/panel-renesas-r61307.c
index 873ef856184b..45afa44af114 100644
--- a/drivers/gpu/drm/panel/panel-renesas-r61307.c
+++ b/drivers/gpu/drm/panel/panel-renesas-r61307.c
@@ -14,6 +14,7 @@
 #include <drm/drm_mipi_dsi.h>
 #include <drm/drm_modes.h>
 #include <drm/drm_panel.h>
+#include <drm/drm_probe_helper.h>
 
 #define R61307_MACP		0xb0 /* Manufacturer CMD Protect */
 #define   R61307_MACP_ON	0x03
@@ -202,25 +203,13 @@ static const struct drm_display_mode renesas_r61307_mode = {
 	.vtotal = 1024 + 24 + 8 + 2,
 	.width_mm = 76,
 	.height_mm = 101,
+	.type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
 };
 
 static int renesas_r61307_get_modes(struct drm_panel *panel,
 				    struct drm_connector *connector)
 {
-	struct drm_display_mode *mode;
-
-	mode = drm_mode_duplicate(connector->dev, &renesas_r61307_mode);
-	if (!mode)
-		return -ENOMEM;
-
-	drm_mode_set_name(mode);
-
-	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
-	connector->display_info.width_mm = mode->width_mm;
-	connector->display_info.height_mm = mode->height_mm;
-	drm_mode_probed_add(connector, mode);
-
-	return 1;
+	return drm_connector_helper_get_modes_fixed(connector, &renesas_r61307_mode);
 }
 
 static const struct drm_panel_funcs renesas_r61307_panel_funcs = {
diff --git a/drivers/gpu/drm/panel/panel-renesas-r69328.c b/drivers/gpu/drm/panel/panel-renesas-r69328.c
index 46287ab04c30..b40bfd702fac 100644
--- a/drivers/gpu/drm/panel/panel-renesas-r69328.c
+++ b/drivers/gpu/drm/panel/panel-renesas-r69328.c
@@ -14,6 +14,7 @@
 #include <drm/drm_mipi_dsi.h>
 #include <drm/drm_modes.h>
 #include <drm/drm_panel.h>
+#include <drm/drm_probe_helper.h>
 
 #define R69328_MACP		0xb0 /* Manufacturer Access CMD Protect */
 #define   R69328_MACP_ON	0x03
@@ -167,25 +168,13 @@ static const struct drm_display_mode renesas_r69328_mode = {
 	.vtotal = 1280 + 6 + 3 + 1,
 	.width_mm = 59,
 	.height_mm = 105,
+	.type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED,
 };
 
 static int renesas_r69328_get_modes(struct drm_panel *panel,
 				    struct drm_connector *connector)
 {
-	struct drm_display_mode *mode;
-
-	mode = drm_mode_duplicate(connector->dev, &renesas_r69328_mode);
-	if (!mode)
-		return -ENOMEM;
-
-	drm_mode_set_name(mode);
-
-	mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
-	connector->display_info.width_mm = mode->width_mm;
-	connector->display_info.height_mm = mode->height_mm;
-	drm_mode_probed_add(connector, mode);
-
-	return 1;
+	return drm_connector_helper_get_modes_fixed(connector, &renesas_r69328_mode);
 }
 
 static const struct drm_panel_funcs renesas_r69328_panel_funcs = {
-- 
2.51.0

[PATCH v1 3/5] drm/panel: r61307/r69328: remove redundant checks

[Svyatoslav Ryhel]

This is now done by the DRM framework itself.

Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
 drivers/gpu/drm/panel/panel-renesas-r61307.c | 10 ----------
 drivers/gpu/drm/panel/panel-renesas-r69328.c | 10 ----------
 2 files changed, 20 deletions(-)

diff --git a/drivers/gpu/drm/panel/panel-renesas-r61307.c b/drivers/gpu/drm/panel/panel-renesas-r61307.c
index 45afa44af114..2cc3bd66d6d4 100644
--- a/drivers/gpu/drm/panel/panel-renesas-r61307.c
+++ b/drivers/gpu/drm/panel/panel-renesas-r61307.c
@@ -35,8 +35,6 @@ struct renesas_r61307 {
 
 	struct gpio_desc *reset_gpio;
 
-	bool prepared;
-
 	bool dig_cont_adj;
 	bool inversion;
 	u32 gamma;
@@ -92,9 +90,6 @@ static int renesas_r61307_prepare(struct drm_panel *panel)
 	struct device *dev = &priv->dsi->dev;
 	int ret;
 
-	if (priv->prepared)
-		return 0;
-
 	ret = regulator_enable(priv->vcc_supply);
 	if (ret) {
 		dev_err(dev, "failed to enable vcc power supply\n");
@@ -113,7 +108,6 @@ static int renesas_r61307_prepare(struct drm_panel *panel)
 
 	renesas_r61307_reset(priv);
 
-	priv->prepared = true;
 	return 0;
 }
 
@@ -175,9 +169,6 @@ static int renesas_r61307_unprepare(struct drm_panel *panel)
 {
 	struct renesas_r61307 *priv = to_renesas_r61307(panel);
 
-	if (!priv->prepared)
-		return 0;
-
 	usleep_range(10000, 11000);
 
 	gpiod_set_value_cansleep(priv->reset_gpio, 1);
@@ -187,7 +178,6 @@ static int renesas_r61307_unprepare(struct drm_panel *panel)
 	usleep_range(2000, 3000);
 	regulator_disable(priv->vcc_supply);
 
-	priv->prepared = false;
 	return 0;
 }
 
diff --git a/drivers/gpu/drm/panel/panel-renesas-r69328.c b/drivers/gpu/drm/panel/panel-renesas-r69328.c
index b40bfd702fac..b5fe127634ae 100644
--- a/drivers/gpu/drm/panel/panel-renesas-r69328.c
+++ b/drivers/gpu/drm/panel/panel-renesas-r69328.c
@@ -33,8 +33,6 @@ struct renesas_r69328 {
 	struct regulator *vdd_supply;
 	struct regulator *vddio_supply;
 	struct gpio_desc *reset_gpio;
-
-	bool prepared;
 };
 
 static inline struct renesas_r69328 *to_renesas_r69328(struct drm_panel *panel)
@@ -56,9 +54,6 @@ static int renesas_r69328_prepare(struct drm_panel *panel)
 	struct device *dev = &priv->dsi->dev;
 	int ret;
 
-	if (priv->prepared)
-		return 0;
-
 	ret = regulator_enable(priv->vdd_supply);
 	if (ret) {
 		dev_err(dev, "failed to enable vdd power supply\n");
@@ -77,7 +72,6 @@ static int renesas_r69328_prepare(struct drm_panel *panel)
 
 	renesas_r69328_reset(priv);
 
-	priv->prepared = true;
 	return 0;
 }
 
@@ -142,9 +136,6 @@ static int renesas_r69328_unprepare(struct drm_panel *panel)
 {
 	struct renesas_r69328 *priv = to_renesas_r69328(panel);
 
-	if (!priv->prepared)
-		return 0;
-
 	gpiod_set_value_cansleep(priv->reset_gpio, 1);
 
 	usleep_range(5000, 6000);
@@ -152,7 +143,6 @@ static int renesas_r69328_unprepare(struct drm_panel *panel)
 	regulator_disable(priv->vddio_supply);
 	regulator_disable(priv->vdd_supply);
 
-	priv->prepared = false;
 	return 0;
 }
 
-- 
2.51.0

[PATCH v1 4/5] drm/panel: r61307/r69328: return accumulated errors

[Svyatoslav Ryhel]

Return accumulated errors from dsi function calls.

Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
 drivers/gpu/drm/panel/panel-renesas-r61307.c | 4 ++--
 drivers/gpu/drm/panel/panel-renesas-r69328.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/panel/panel-renesas-r61307.c b/drivers/gpu/drm/panel/panel-renesas-r61307.c
index 2cc3bd66d6d4..70bda074dd0d 100644
--- a/drivers/gpu/drm/panel/panel-renesas-r61307.c
+++ b/drivers/gpu/drm/panel/panel-renesas-r61307.c
@@ -150,7 +150,7 @@ static int renesas_r61307_enable(struct drm_panel *panel)
 	mipi_dsi_dcs_set_display_on_multi(&ctx);
 	mipi_dsi_msleep(&ctx, 50);
 
-	return 0;
+	return ctx.accum_err;
 }
 
 static int renesas_r61307_disable(struct drm_panel *panel)
@@ -162,7 +162,7 @@ static int renesas_r61307_disable(struct drm_panel *panel)
 	mipi_dsi_msleep(&ctx, 100);
 	mipi_dsi_dcs_enter_sleep_mode_multi(&ctx);
 
-	return 0;
+	return ctx.accum_err;
 }
 
 static int renesas_r61307_unprepare(struct drm_panel *panel)
diff --git a/drivers/gpu/drm/panel/panel-renesas-r69328.c b/drivers/gpu/drm/panel/panel-renesas-r69328.c
index b5fe127634ae..0ed143f77e50 100644
--- a/drivers/gpu/drm/panel/panel-renesas-r69328.c
+++ b/drivers/gpu/drm/panel/panel-renesas-r69328.c
@@ -117,7 +117,7 @@ static int renesas_r69328_enable(struct drm_panel *panel)
 	mipi_dsi_dcs_set_display_on_multi(&ctx);
 	mipi_dsi_msleep(&ctx, 50);
 
-	return 0;
+	return ctx.accum_err;
 }
 
 static int renesas_r69328_disable(struct drm_panel *panel)
@@ -129,7 +129,7 @@ static int renesas_r69328_disable(struct drm_panel *panel)
 	mipi_dsi_msleep(&ctx, 60);
 	mipi_dsi_dcs_enter_sleep_mode_multi(&ctx);
 
-	return 0;
+	return ctx.accum_err;
 }
 
 static int renesas_r69328_unprepare(struct drm_panel *panel)
-- 
2.51.0

[PATCH v1 5/5] drm/panel: r61307/r69328: convert to devm_mipi_dsi_attach

[Svyatoslav Ryhel]

Switch to device managed version of mipi_dsi_attach.

Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
---
 drivers/gpu/drm/panel/panel-renesas-r61307.c | 7 +------
 drivers/gpu/drm/panel/panel-renesas-r69328.c | 7 +------
 2 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/panel/panel-renesas-r61307.c b/drivers/gpu/drm/panel/panel-renesas-r61307.c
index 70bda074dd0d..d8185cc1b5d6 100644
--- a/drivers/gpu/drm/panel/panel-renesas-r61307.c
+++ b/drivers/gpu/drm/panel/panel-renesas-r61307.c
@@ -261,7 +261,7 @@ static int renesas_r61307_probe(struct mipi_dsi_device *dsi)
 
 	drm_panel_add(&priv->panel);
 
-	ret = mipi_dsi_attach(dsi);
+	ret = devm_mipi_dsi_attach(dev, dsi);
 	if (ret) {
 		drm_panel_remove(&priv->panel);
 		return dev_err_probe(dev, ret, "Failed to attach to DSI host\n");
@@ -273,11 +273,6 @@ static int renesas_r61307_probe(struct mipi_dsi_device *dsi)
 static void renesas_r61307_remove(struct mipi_dsi_device *dsi)
 {
 	struct renesas_r61307 *priv = mipi_dsi_get_drvdata(dsi);
-	int ret;
-
-	ret = mipi_dsi_detach(dsi);
-	if (ret)
-		dev_err(&dsi->dev, "Failed to detach from DSI host: %d\n", ret);
 
 	drm_panel_remove(&priv->panel);
 }
diff --git a/drivers/gpu/drm/panel/panel-renesas-r69328.c b/drivers/gpu/drm/panel/panel-renesas-r69328.c
index 0ed143f77e50..bfe2787f8f53 100644
--- a/drivers/gpu/drm/panel/panel-renesas-r69328.c
+++ b/drivers/gpu/drm/panel/panel-renesas-r69328.c
@@ -217,7 +217,7 @@ static int renesas_r69328_probe(struct mipi_dsi_device *dsi)
 
 	drm_panel_add(&priv->panel);
 
-	ret = mipi_dsi_attach(dsi);
+	ret = devm_mipi_dsi_attach(dev, dsi);
 	if (ret) {
 		drm_panel_remove(&priv->panel);
 		return dev_err_probe(dev, ret, "Failed to attach to DSI host\n");
@@ -229,11 +229,6 @@ static int renesas_r69328_probe(struct mipi_dsi_device *dsi)
 static void renesas_r69328_remove(struct mipi_dsi_device *dsi)
 {
 	struct renesas_r69328 *priv = mipi_dsi_get_drvdata(dsi);
-	int ret;
-
-	ret = mipi_dsi_detach(dsi);
-	if (ret)
-		dev_err(&dsi->dev, "Failed to detach from DSI host: %d\n", ret);
 
 	drm_panel_remove(&priv->panel);
 }
-- 
2.51.0

Claude review: None

[Claude Code Review Bot]

Overall Series Review

Subject: None
Author: None
Patches: 0
Reviewed: 2026-02-15T19:01:01.789602

---

This 8-patch series adds batch userptr allocation support to amdkfd, allowing multiple non-contiguous CPU virtual address ranges to be mapped to a single contiguous GPU virtual address space via the existing `AMDKFD_IOC_ALLOC_MEMORY_OF_GPU` ioctl. The design uses a single MMU interval notifier covering the VA span with an interval tree for efficient range lookup during invalidation callbacks, which is a sound architectural choice.

The series has several significant issues that need addressing before it can be merged. The most critical are: (1) missing upper bound on `num_ranges` from userspace, allowing excessive kernel memory allocation; (2) the return value of `set_user_pages_batch()` is silently ignored in `init_user_pages_batch()`, which could lead to `ttm_bo_validate` operating on a corrupt pages array; (3) the error paths in `amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu_batch()` leak the mem limit reservation when `drm_vma_node_allow()` or `drm_gem_handle_create()` fails; and (4) the `size` parameter of `init_user_pages_batch()` is `uint32_t` but receives a `uint64_t` value, silently truncating sizes above 4GB.

Additionally, the patch references functions (`amdgpu_ttm_tt_get_user_pages_done`, `amdgpu_ttm_tt_discard_user_pages`) and uses types (`struct hmm_range *` in `user_range_info`) that do not match the upstream kernel tree's API (`amdgpu_hmm_range_alloc`/`amdgpu_hmm_range_free`, `struct amdgpu_hmm_range *`). This suggests the series was developed against an AMD staging tree with a different internal API, and needs reconciliation for upstream submission.

---
Generated by Claude Code Patch Reviewer

Claude review: drm/panel: r61307: align with schema property

[Claude Code Review Bot]

Patch Review

Single line change: renames `"renesas,inversion"` to `"renesas,column-inversion"` in `device_property_read_bool()`.

The DT binding schema (`Documentation/devicetree/bindings/display/panel/renesas,r61307.yaml` line 45) already specifies `renesas,column-inversion`. No in-tree DTS files use either property name (`grep` across `*.dts*` returns no matches). The rename aligns the driver with the documented binding.

No regressions.

---
Generated by Claude Code Patch Reviewer

Claude review: drm/panel: r61307/r69328: convert to drm_connector_helper_get_modes_fixed

[Claude Code Review Bot]

Patch Review

Replaces hand-rolled `get_modes` implementations with `drm_connector_helper_get_modes_fixed()`. Adds `select VIDEOMODE_HELPERS` to Kconfig and `#include <drm/drm_probe_helper.h>`.

The helper (`drm_probe_helper.c:1158`) performs the same operations:
- `drm_mode_duplicate()` 
- `drm_mode_set_name()` (conditionally, if name is empty)
- ORs `DRM_MODE_TYPE_PREFERRED` onto `mode->type`
- Sets `display_info.width_mm/height_mm` from the mode
- `drm_mode_probed_add()`

The `.type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED` is moved into the static mode struct. The helper's `mode->type |= DRM_MODE_TYPE_PREFERRED` is idempotent since PREFERRED is already set. The helper returns 0 on failure instead of -ENOMEM, but `drm_panel_get_modes()` already clamps negative returns to 0.

No regressions.

---
Generated by Claude Code Patch Reviewer

Claude review: drm/panel: r61307/r69328: remove redundant checks

[Claude Code Review Bot]

Patch Review

Removes the `bool prepared` field and `if (priv->prepared)` / `if (!priv->prepared)` guards from prepare/unprepare. The commit message states "This is now done by the DRM framework itself."

Verified: `drm_panel_prepare()` (drm_panel.c:122) checks `panel->prepared` and skips if already true, sets it to true after the callback succeeds. `drm_panel_unprepare()` (drm_panel.c:177) checks `!panel->prepared` and skips if already false. The framework tracking is equivalent to the removed driver-level tracking.

No regressions.

---
Generated by Claude Code Patch Reviewer

Claude review: drm/panel: r61307/r69328: return accumulated errors

[Claude Code Review Bot]

Patch Review

Changes `enable` and `disable` to return `ctx.accum_err` instead of unconditional `return 0`. The `mipi_dsi_multi_context` accumulates errors from `_multi` DSI calls. Previously, DSI communication failures were silently swallowed.

This is strictly an improvement - errors that were previously hidden are now propagated to callers.

No regressions.

---
Generated by Claude Code Patch Reviewer

Claude review: drm/panel: r61307/r69328: convert to devm_mipi_dsi_attach

[Claude Code Review Bot]

Patch Review

Replaces `mipi_dsi_attach()` / manual `mipi_dsi_detach()` with `devm_mipi_dsi_attach()`. The manual detach in `remove()` is deleted.

Ordering is correct: the `remove()` callback (which calls `drm_panel_remove()`) executes before devm cleanup (which calls `mipi_dsi_detach()`), maintaining the same order as the original code. This is the standard pattern used by many panel drivers (e.g., panel-samsung-ams581vf01, panel-magnachip-d53e6ea8966, panel-lg-ld070wx3).

No regressions.

---

FINAL REGRESSIONS FOUND: 0

False positives eliminated:
- `drm_connector_helper_get_modes_fixed` returning 0 vs -ENOMEM: framework clamps negative returns to 0 in `drm_panel_get_modes()`
- Double-OR of `DRM_MODE_TYPE_PREFERRED`: idempotent bit operation
- devm cleanup ordering: `remove()` runs before devm teardown, preserving correct order
- DT property rename breaking users: no in-tree DTS files use either name

---

`review-metadata.json` content (could not write due to permissions):

```json
{
  "author": "Svyatoslav Ryhel <clamor95@gmail.com>",
  "sha": "c0c75a7fd8740..5d718d96a1186",
  "subject": "drm/panel: r61307/r69328: modernization series",
  "AI-authorship-score": "low",
  "AI-authorship-explanation": "Mechanical driver cleanup by a known panel driver contributor, following standard kernel modernization patterns with terse commit messages.",
  "issues-found": 0,
  "issue-severity-score": "low",
  "issue-severity-explanation": "none"
}
```

FINAL TOKENS USED: ~45000 (estimated)

---
Generated by Claude Code Patch Reviewer