kernel/git/next/linux-next.git/drivers/gpu/drm/v3d, branch master

Merge branch 'drm-next' of https://gitlab.freedesktop.org/drm/kernel.git

2026-07-13T12:09:55+00:00

# Conflicts: # drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h # drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c

drm/v3d: bound CPU-job query writes to their destination BO

2026-07-08T12:15:42+00:00

The V3D_SUBMIT_CPU CPU jobs take user-supplied offsets and indices and consume them at exec time without checking that the accesses stay inside their BO: - TIMESTAMP_QUERY and RESET_TIMESTAMP_QUERY write one u64 per query into bo[0] at a fully user-controlled per-query offset. - COPY_TIMESTAMP_QUERY copies one u64 per query into bo[0] at offset + i * stride, and reads each result from a user-controlled offset in the source bo[1]. - COPY_PERFORMANCE_QUERY writes nperfmons * DRM_V3D_MAX_PERF_COUNTERS counter slots plus an availability slot into bo[0] at the same geometry. - INDIRECT_CSD reads three u32 work-group counts from bo[0] at a user-controlled offset, then writes each count back into the indirect BO at a user-controlled u32 index (wg_uniform_offsets[]). A render-node user (DRM_RENDER_ALLOW, no master, no capability) can make the handlers read or write past a BO's vmap mapping. Validate the full access extent against the BO size once the BOs are looked up, before the job is queued, rejecting out-of-range geometry with -EINVAL. The copy extent offset + (count - 1) * stride + write_size is computed in u64, mirroring the u8 * pointer arithmetic in the executors: (count - 1) * stride is a u32 * u32 product that is exact in u64, so one overflow check on the total guards the bound. The performance slot count and the bare timestamp, copy-source and indirect offsets are computed in u64 the same way, so a user value cannot wrap the comparison. Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Fixes: 9ba0ff3e083f ("drm/v3d: Create a CPU job extension for the timestamp query job") Fixes: 34a101e64296 ("drm/v3d: Create a CPU job extension for the reset timestamp job") Fixes: 6745f3e44a20 ("drm/v3d: Create a CPU job extension to copy timestamp query to a buffer") Fixes: 209e8d2695ee ("drm/v3d: Create a CPU job extension for the copy performance query job") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito Reviewed-by: Maíra Canal Signed-off-by: Maíra Canal Link: https://patch.msgid.link/20260707221334.3854433-1-michael.bommarito@gmail.com

drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

2026-07-07T21:52:13+00:00

v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time. Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Reviewed-by: Iago Toral Quiroga Signed-off-by: Maíra Canal Link: https://patch.msgid.link/20260703-v3d-cpu-job-fixes-v3-2-bc51b1f3eeb5@igalia.com

drm/v3d: Use write_to_buffer() helper in performance query copy

2026-07-07T21:21:42+00:00

The copy of performance query results to the output buffer open-codes the 32-bit/64-bit selection with two nearly identical loops. As the write_to_buffer() helper already encapsulates the do_64bit decision, use it instead of open-coding it. Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260703-v3d-cpu-job-fixes-v3-3-bc51b1f3eeb5@igalia.com Signed-off-by: Maíra Canal

drm/v3d: Serialize jobs across queues when a perfmon is attached

2026-07-07T19:58:46+00:00

A non-global perfmon is meant to count events generated by a specific submission, but the scheduler can run jobs from different queues concurrently on the same V3D core. Without explicit serialization, an unrelated job running in parallel with a perfmon-carrying job pollutes the counters and generates unusable results. To address such issue, we must enforce cross-queue serialization when we detect a perfmon-carrying submission. It's possible to implement serialization by enforcing two rules: 1. A job that carries a non-global perfmon must wait for every job currently in-flight across all HW queues to finish. 2. While a perfmon-carrying job is still in-flight, all subsequently submitted jobs must wait for it. Note that serialization is not needed in the global perfmon case, as the global perfmon tracks activity from all jobs, so concurrency is desirable. Therefore, check if serialization is needed during job submission and if so, attach fence dependences to enforce cross-queue serialization. Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260706-v3d-perfmon-lifetime-v4-2-d7b312ff2c83@igalia.com Signed-off-by: Maíra Canal

drm/v3d: Refactor perfmon locking

2026-07-07T19:58:46+00:00

v3d exposes a single set of performance counters per core, so at any moment at most one performance monitor can be programmed in HW. In software, this singleton is represented by v3d_dev->active_perfmon, but until now nothing actually serialized access to it: scheduler callbacks, the GPU-reset path, and perfmon ioctls all read and wrote that field lock-free. The existence of v3d_perfmon->lock mutex did not close the gap. It serialized start/stop of *one* perfmon object against itself, but the invariant that needs protection is device-wide: there can be exactly one active perfmon at any moment in HW. Two threads acting on different perfmon objects could race through v3d_dev->active_perfmon and the counter registers, leaving software and HW out of sync. This commit moves the locking to where the invariant actually lives. Group the active perfmon pointer with a device-wide spinlock and route every state transition (job start, job completion, set global, reset, suspend/resume, destruction) through a small set of locked entry points that are the only mutators of the HW counters. Some design improvements needed to be made for the refactor: 1. Stop the perfmon from the IRQ handler at job-completion time (the natural boundary for "active perfmon follows the active job"). This required a change from a mutex to a spinlock. This solves another issue of the existing design: perfmon start/stop was exclusively attached to run_job() callbacks, which means that if nothing was further queued up, a perfmon would never actually be stopped. 2. Pause/resume the HW counters across runtime-PM transitions without dropping the software reference. This preserves the perfmon state while the device is idle. 3. Move the global perfmon lifecycle management to the set_global IOCTL. This simplifies the logic in v3d_perfmon_start() and v3d_perfmon_stop(), as there is no need to always check if the global perfmon is enabled. 4. v3d_perfmon_get_values_ioctl() doesn't stop the perfmon when capturing the values. All lifecycle management is handled by the job (for per-job perfmons) or the set_global IOCTL (for global perfmons). Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260706-v3d-perfmon-lifetime-v4-1-d7b312ff2c83@igalia.com Signed-off-by: Maíra Canal

Merge drm/drm-next into drm-misc-next

2026-06-30T08:16:00+00:00

Backmerging to get drm-misc-next to v7.2-rc1. Signed-off-by: Thomas Zimmermann

Merge tag 'drm-next-2026-06-17' of https://gitlab.freedesktop.org/drm/kernel

2026-06-17T09:21:00+00:00

Pull drm updates from Dave Airlie: "Highlights: - xe: add initial CRI platform support - amdgpu: initial HDMI 2.1 FRL support - rust: add some new type concepts for device lifetimes - scheduler: moves to a fair algorithm and lots of cleanups But it's mostly the usual mountain of changes across the board. core: - add docbook for DRM_IOCTL_SYNCOBJ_EVENTFD - change signature of drm_connector_attach_hdr_output_metadata_property - dedup counter and timestamp retrieval in vblank code - parse AMD VSDB v3 in CTA extension blocks - add P230, Y7, XYYY2101010, T430, XVUY210101010 formats - don't call drop master on file close if not master - use drm_printf_indent in atomic / bridge - fix 32b format descriptions - docs: fix toctree - hdmi: add common TMDS character rates - fix drm_syncobj_find_fence leak rust: - introduce Higher-Ranked lifetime types - replace drvdata with scoped registration data - add GPUVM immediate mode abstraction for rust GPU drivers - introduce DeviceContext type state for drm::Device bridge: - clarify drm_bridge_get/put - create drm_get_bridge_by_endpoint and use it - analogix_dp: add panel probing - ite-it6211 - use drm audio hdmi helpers buddy: - add lockdep annotations dp: - add PR and VRR updates - mst: fix buffer overflows - add Adaptive Sync SDP decoding support - fix OOB reads in dp-mst ttm: - bump fpfn/lpfn to 64-bit scheduler: - change default to fair scheduler - map runqueue 1:1 with scheduler dma-buf: - port selftests to kunit - convert dma-buf system/heap allocators to module - add separate DMABUF_HEAPS_SYSTEM_CC_SHARED Kconfig udmabuf: - revert hugetlb support - fix error with CONFIG_DMA_API_DEBUG dma-fence: - fix tracepoints lifetime - remove unused signal on any support ras: - add clear error counter netlink command to drm ras gpusvm: - reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges - use IOVA allocations pagemap: - use IOVA allocations panels: - update to use ref counts - add support for CSW PNB601LS1-2, LGD LP116WHA-SPB1 - add support for waveshare panels - CMN N116BCN-EA1, CMN N140HCA-EEK, IVO M140NWFQ R5, - IVO, R140NWFW R0, BOE NT140*, BOE NV133FHM-N4F, - AUO B140*, AUO B133HAN06.6 and AUO B116XTN02.3 eDP panels - Surface Pro 12 Panel xe: - add CRI PCI-IDs - debugfs add multi-lrc info - engine init cleanup - PF fair scheduling auto provisioning - system controller support for CRI/Xe3p - PXP state machine fixes - Reset/wedge/unload corner case fixes - Wedge path memory allocation fixes - PAT type cleanups - Reject unsafe PAT for CPU cached memory - OA improvements for CRI device memory - kernel doc syntax in xe headers - xe_drm.h documentation fixes - include guard cleanups - VF CCS memory pool - i915/xe step unification - Xe3p GT tuning fixes - forcewake cleanup in GT and GuC - admin-only PF mode - enable hwmon energy attributes for CRI - enable GT_MI_USER_INTERRUPT - refactor emit functions - oa workarounds - multi_queue: allow QUEUE_TIMESTAMP register - convert stolen memory to ttm range manager - use xe2 style blitter as a feature flag - make drm_driver const - add/use IRQ page to HW engine definition - fix oops when display disabled i915: - enable PIPEDMC_ERROR interrupt - more common display code refactoring - restructure DP/HDMI sink format handling - eliminate FB usage from lowlevel pinning code - panel replay bw optimization - integrate sharpness filter into the scaler - new fb_pin abstraction for xe/i915 fb transparent handling - skip inactive MST connectors on HDCP - start switching to display specific registers - use polling when irq unavailable - Adaptive-sync SDP prep amdgpu: - use drm_display_info for AMD VSDB data - Initial HDMI 2.1 FRL support - Initial DCN 4.2.1 support - GART fixes for non-4k pages - GC 11.5.6/SDMA 6.4.0/and other new IPs - GFX9/DCE6/Hawaii/SDMA4/GART/Userq fixes - Finish support for using multiple SDMA queues for TTM operations - SWSMU updates - GC 12.1 updates - SMU 15.0.8 updates - DCN 4.2 updates - DC type conversion fixes - Enable DC power module - Replay/PSR updates - SMU 13.x updates - Compute queue quantum MQD updates - ASPM fix - Align VKMS with common implementation - DC analog support fixes - UVD 3 fixes - TCC harvesting fixes for SI - GC 11 APU module reload fix - NBIO 6.3.2 support - IH 7.1 updates - DC cursor fixes - VCN/JPEG user fence fixes - DC support for connectors without DDC - Prefer ROM BAR for default VGA device - DC bandwidth fixes - Add PTL support for profiler - Introduce dc_plane_cm and migrate surface update color path - Add FRL registers for HDMI 2.1 - Restructure VM state machine - Auxless ALPM support - GEM_OP locking/warning fixes - switch to system_dfl_wq amdkfd: - GPUVM TLB flush fix - Hotplug fix - Boundary check fixes - SVM fixes - CRIU fixes - add profiler API - MES 12.1 updates msm: - core: - fix shrinker documentation - IFPC enabled for gen8 - PERFCNTR_CONFIG ioctl support - GPU: - reworked UBWC handling - a810 support - MDSS: - add support for Milos platform - reworked UBWC handling - DisplayPort: - reworked HPD handling as prep for MST - DPU: - Milos platform support - reworked UBWC handling - DSI: - Milos platform support nova: - Hopper/Blackwell enablement (GH100/GB100/GB202) - FSP support - 32-bit firmware support - HAL functions - refactor GSP boot/unload - GA100 support - VBIOS hardening/refactoring - Adopt higher order lifetime types tyr: - define register blocks - add shmem backed GEM objects - adopt higher order lifetime types - move clock cleanup into Drop radeon: - Hawaii SMU fixes - CS parser fix - use struct drm_edid instead of edid amdxdna: - export per-client BO memory via fdinfo - AIE4 device support - support medium/lower power modes - expandable device heap support - revert read-only user-pointer BO mappings ivpu: - support frequency limiting panthor: - enable GEM shrinker support - add eviction and reclaim info to fdinfo v3d: - enable runtime PM mgag200: - support XRGB1555 + C8 ast: - support XRGB1555 + C8 - use constants for lots of registers - fix register handling imagination: - fence handling refactoring nouveau: - fix sched double call - expose VBIOS on GSP-RM systems - add GA100 support virtio: - add VIRTIO_GPU_F_BLOB_ALIGNMENT flag - add deferred mapping support gud: - add RCade Display Adapter hibmc: - fix no connectors usage mediatek: - hdmi: convert error handling - simplify mtk_crtc allocation exynos: - move fbdev emulation to drm client buffers - use drm format helpers for geometry/size - adopt core DMA tracking - fix framebuffer offset handling renesas: - add RZ/T2H SOC support versilicon: - add cursor plane support tegra: - use drm client for framebuffer" * tag 'drm-next-2026-06-17' of https://gitlab.freedesktop.org/drm/kernel: (1731 commits) dma-buf: move system_cc_shared heap under separate Kconfig accel/amdxdna: Clear sva pointer after unbind agp/amd64: Fix broken error propagation in agp_amd64_probe() accel/amdxdna: Require carveout when PASID and force_iova are disabled drm/amdkfd: always resume_all after suspend_all drm/amdgpu/gfx: move fault and EOP IRQ get/put to hw_init/hw_fini drm/amd/display: Consult MCCS FreeSync cap only if requested & supported drm/amd/pm: Use strscpy in profile mode parsing drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length drm/amdkfd: fix sysfs topology prop length on buffer truncation drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages drm/amd/pm: bound OD parameter parsing to stack array size drm/amd/pm: Stop pp_od_clk_voltage emit at PAGE_SIZE drm/amdkfd: Unwind debug trap enable on copy_to_user failure drm/amdgpu: validate the mes firmware version for gfx12.1 drm/amdgpu: validate the mes firmware version for gfx12 drm/amdgpu: compare MES firmware version ucode for gfx11 drm/amdkfd: Add bounds check for AMDKFD_IOC_WAIT_EVENTS drm/amdgpu: restart the CS if some parts of the VM are still invalidated drm/amd/display: use unsigned types for local pipe and REG_GET counters ...

drm/v3d: Deprecate V3D 3.3 and 4.1 support

2026-06-09T18:03:21+00:00

V3D 3.3 (Broadcom BCM7268) and V3D 4.1 (Broadcom BCM7278) has had no in-tree userspace since Mesa dropped support in 2024, on the grounds that those generations were no longer being tested. The situation in the kernel is similar: the maintainers don't have this hardware, the hardware is not available for purchase, and there is no known user of these GPUs. With no userspace left to drive it and no known users, maintaining the ver <= 41 code paths is a cost without a benefit, considering that these paths are not being exercised on real hardware. As a first step toward removal, emit a deprecation warning at probe for V3D versions earlier than or equal to 4.1. The hardware remains functional for now; this only warns. If any real user appears and explain its use-case, support can be retained. Schedule the removal of V3D 3.3 and 4.1 support to the next kernel release. Link: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/25851 Reviewed-by: Florian Fainelli Reviewed-by: Iago Toral Quiroga Link: https://patch.msgid.link/20260606185616.694188-2-mcanal@igalia.com Signed-off-by: Maíra Canal

drm/v3d: Ensure atomic submissions in v3d_submit_jobs()

2026-06-09T17:43:59+00:00

Currently, v3d_submit_jobs() arms and pushes each job one at a time, wiring dependencies between consecutive jobs after each push. If drm_sched_job_add_dependency() fails midway, the already-pushed jobs are scheduler-owned and will be submitted to the GPU for execution, even though the subsequent jobs won't be submitted. This breaks the atomicity of the submissions, as only some of the jobs from a submission would be submitted to the hardware, while the other part fails. Restructure v3d_submit_jobs() into three phases: (1) arm all jobs belonging to a given submission, (2) wire inter-job dependencies, and (3) push all jobs to the scheduler unconditionally. Phase (2) can fail; on failure, it marks every armed job finished fence with an error, so that run_job() callbacks skip hardware execution. This guarantees that every armed job is always pushed, either to run or to be skipped, and it also ensures the atomicity of a submission. Suggested-by: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patch.msgid.link/20260604-v3d-sched-misc-fixes-v4-12-c068f5bf5ccf@igalia.com Signed-off-by: Maíra Canal