summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-08-25drm/amd/display: add a NULL pointer checkCharlene Liu
[why] a fix for a memory crash stress test Reviewed-by: Chris Park <chris.park@amd.com> Signed-off-by: Charlene Liu <charlene.liu@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: fix HPD program filter programmingCharlene Liu
[why] fix a regression when moving logic from dal_hw_hpd_set_config to link_enc: Toggle_filter HW register programming is in wrong unit, which caused the connection time extreamly long. Reviewed-by: Ovidiu Bunea <ovidiu.bunea@amd.com> Signed-off-by: Charlene Liu <Charlene.Liu@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Fix HostVM init and SOCBB VM config for DCN6Nicholas Kazlauskas
[Why] Underflow occurs in testing for DCHVM and RIOMMU interop tests when attempting to scan out surfaces in VM. [How] New registers have been added to DCN6 for HostVM to control which VFID to prefetch by default. These need to be programmed during the VM init sequence. The sequence validated from DCN42 is used (and xref'd with the design documentation with hardware) with the register placed in an ordering that appears correct. HostVM and GPUVM are also currently disabled and set an incorrect number of page table levels and min page size in the SOCBB for DCN6b. These are updated, but driver also needs to select the B variant when creating the SOC BB to ensure that they're piped into DML. Lastly, the init function for the vm context is branched out to skip initializing VMID 15 - this workaround should no longer be necessary on DCN6. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: clamp force_min_dcfclk to dcn42b rangeGabe Teeger
[Why] The force_min_dcfclk_mhz debug option can request a DCFCLK outside the dcn42b hardware limits, which risks driving the clock below its minimum or above its maximum. [How] Add a dcn42b_update_clocks wrapper that clamps force_min_dcfclk_mhz to [200, 600] MHz (0 leaves it disabled) before calling the shared dcn42_update_clocks, keeping the clamp specific to dcn42b, and wire it into the dcn42b clk_mgr funcs. Reviewed-by: Ovidiu Bunea <ovidiu.bunea@amd.com> Signed-off-by: Gabe Teeger <gabe.teeger@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Add KUnit tests for amdgpu_dm_crtc_helper_atomic_checkBhawanpreet Lakha
why: Expand CRTC KUnit coverage to the atomic_check helper so its branch behaviour is exercised and protected against regressions. how: Expose amdgpu_dm_crtc_helper_atomic_check for KUnit (STATIC_IFN_KUNIT + EXPORT_IF_KUNIT + header declaration). Add tests covering the no-stream (reset) pass, enabled-CRTC-without-primary rejection, async-flip non-fast rejection, the VRR primary-plane pull path, and DC stream validation pass/fail using timing_generator and link_service stubs. Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Add amdgpu_dm_crtc_init testsBhawanpreet Lakha
why: amdgpu_dm_crtc_init builds a CRTC with its primary and cursor planes, resets its state, and records it in mode_info, but had no coverage for either the default or the degamma-enabled configuration path. how: Add dm_test_crtc_init_registers_crtc for the default (has_degamma == false) path and dm_test_crtc_init_enables_degamma for the DCN DPP (has_degamma == true) path. Both set up an adev, dc with ctx, and a primary plane, call amdgpu_dm_crtc_init, and verify it returns 0, registers the CRTC, and initializes the expected fields, then tear down the reset state, CRTC, and cursor plane the function allocated. The remaining branches are allocation failures and unreachable defensive paths not drivable under KUnit. Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Add amdgpu_dm_crtc_late_register testBhawanpreet Lakha
why: amdgpu_dm_crtc_late_register wires up the CRTC debugfs entries during registration but had no coverage, leaving its single path untested. how: Expose amdgpu_dm_crtc_late_register for KUnit via STATIC_IFN_KUNIT and EXPORT_IF_KUNIT (guarded by CONFIG_DEBUG_FS) and declare it in the KUnit header block. Add dm_test_crtc_late_register_inits_debugfs, which gives the CRTC a real debugfs parent, calls the callback, verifies it returns 0, and tears down the debugfs directory. Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Add reset_state existing-state branch testBhawanpreet Lakha
why: amdgpu_dm_crtc_reset_state has a branch that destroys an already-installed crtc state before allocating a new one. Only the NULL-state branch was covered, leaving the state-replacement path untested. how: Add dm_test_crtc_reset_state_replaces_existing, which installs a plain dm_crtc_state holding an extra stream reference, calls reset_state, and verifies the old state was destroyed (stream ref dropped) and a fresh non-NULL state was installed. Register the new case under the existing reset_state group. Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Cover crtc destroy callbackBhawanpreet Lakha
[why] The amdgpu_dm_crtc_destroy() .destroy callback, which runs drm_crtc_cleanup() and frees the CRTC, was not exercised by the KUnit suite. [how] Exposed amdgpu_dm_crtc_destroy() via STATIC_IFN_KUNIT/EXPORT_IF_KUNIT and a KUnit-only declaration, and added dm_test_crtc_destroy_cleans_up_and_frees which initializes a CRTC with a primary plane and verifies mode_config.num_crtc drops from 1 to 0 after destroy. Registered the case in amdgpu_dm_crtc_tests. Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Cover crtc duplicate_state stream and null guardBhawanpreet Lakha
[why] The duplicate_state stream-reference and NULL-state guard paths in amdgpu_dm_crtc_duplicate_state were not exercised by the KUnit suite. [how] Added dm_test_crtc_duplicate_state_retains_stream to verify the duplicated state keeps the stream pointer and takes an extra reference that is dropped on destroy, and dm_test_crtc_duplicate_state_null_state_returns_null to verify the WARN_ON guard returns NULL. Registered both cases in amdgpu_dm_crtc_tests. Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Fix audio test errorsSridevi Arvindekar
[Why/How] Use appropriate audio register fields. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Sridevi Arvindekar <sridevi.arvindekar@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Fix crash in DCN5/6 calcs when GPUVM enabledNicholas Kazlauskas
[Why] If vmpg_bytes is 0 and gpuvm is enabled then we divide by zero. [How] Take the same path as gpuvm disabled when vmpg_bytes is 0. Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Add support for overriding UTM client QC profileDillon Varone
[WHY&HOW] Support overriding UTM client QC profiles for testing. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Dillon Varone <Dillon.Varone@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: Add NBIO 7.11.5 supportShubhankar Milind Sardeshpande
Add a new NBIO IP block driver for NBIO 7.11.5 and wire it into the IP discovery table so that the correct nbio and hdp flush register callbacks are selected for IP_VERSION(7, 11, 5). v2: squash in missing callback Signed-off-by: Shubhankar Milind Sardeshpande <Shubhankar.MilindSardeshpande@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: Add NBIO 7.11.5 header filesShubhankar Milind Sardeshpande
Add the NBIO 7.11.5 register offset and shift-mask headers required by the new driver. v2: update register headers (Alex) Signed-off-by: Shubhankar Milind Sardeshpande <Shubhankar.MilindSardeshpande@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25Revert "drm/amdgpu: add support for NBIO IP version 7.11.5"Shubhankar Milind Sardeshpande
This reverts commit 5d2ce32351545e46deb4c6c597585254432a21d0. Signed-off-by: Shubhankar Milind Sardeshpande <Shubhankar.MilindSardeshpande@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: fix dc_lock leak on GPU reset error pathsLinkai Gong
On GPU reset, dm_suspend() takes dc_lock and leaves it for dm_resume() to drop. If amdgpu_dm_commit_zero_streams() or dm_dmub_hw_init() fails, the function returns with the lock still held. The matching resume path is then skipped, so every later dc_lock take hangs. Release the cached DC state and unlock before returning the error. Fixes: 3cf7a0bc87f0 ("drm/amd/display: Catch failures for amdgpu_dm_commit_zero_streams()") Fixes: 2b6943df5413 ("drm/amd/display: Pass up errors for reset GPU that fails to init HW") Cc: stable@vger.kernel.org Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip scheduleSrinivasan Shanmugam
Inside dcn6_calculate_flip_schedule(), GPUVMEnable is already checked in the outer if block. But the same GPUVMEnable is checked again in two inner if blocks inside it. Since GPUVMEnable is always true at that point, the inner else branches that assign meta_row_height are never reached. Remove the redundant inner GPUVMEnable checks and directly assign dpte_row_height, which is always the correct value here. Fixes: 7f7d7ea1fa51 ("drm/amd/display: Add new sources for DCN6") Reported-by: Dan Carpenter <error27@gmail.com> Cc: Roman Li <roman.li@amd.com> Cc: Alex Hung <alex.hung@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10Srinivasan Shanmugam
The pixel format dml2_422_packed_10 needs BytePerPixelDETY set to 8.0/3. But it was accidentally placed in the wrong group that sets it to 4, so the correct value was never used. This caused wrong DET buffer size and bandwidth calculations whenever this format was used. Fix it by moving dml2_422_packed_10 out of the wrong group so it gets the correct value of 8.0/3. Fixes: 7f7d7ea1fa51 ("drm/amd/display: Add new sources for DCN6") Reported-by: Dan Carpenter <error27@gmail.com> Cc: Roman Li <roman.li@amd.com> Cc: Alex Hung <alex.hung@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdkfd: guard against NULL restore_mqd in CRIU queue restoreVladimir Marioukhine
Both create_queue_cpsch() and create_queue_nocpsch() unconditionally call mqd_mgr->restore_mqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restore_mqd is not implemented for the given queue type, a user holding CAP_CHECKPOINT_RESTORE can trigger a kernel NULL pointer dereference and panic the machine by issuing KFD_IOC_CRIU_OP_RESTORE with a crafted queue restore object. Note that checkpoint_mqd is likewise unimplemented on GFX12, so no legitimate CRIU image can reach this path — only a hand-crafted restore payload. Add a NULL guard for restore_mqd immediately after mqd_mgr is resolved, unwinding via the existing error labels and returning -EOPNOTSUPP if the callback is not implemented. This mirrors the existing checkpoint_mqd guard in checkpoint_mqd(). Fixes: 48f0bdf4e38e ("drm/amdkfd: Added MQD manager files for GFX12.") Cc: stable@vger.kernel.org Signed-off-by: Vladimir Marioukhine <Vladimir.Marioukhine@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu/userq: fix lock missing for userq fence error setPrike Liang
amdgpu_userq_fence_driver() and amdgpu_userq_fence_driver_destroy() don't acquire the dma_fence spinlock, so locking the dma_fence lock before test the signaled state and set error state to avoid missing lock assert error. Signed-off-by: Prike Liang <Prike.Liang@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vramXiaogang Chen
When migration vm range is hole at cpu side(MIGRATE_PFN_MIGRATE set + MIGRATE_PFN_VALID unset) driver still allocates device pages. There is no dma map of src pages and migration. j is 0 and svm_migrate_copy_memory_gart() will return an uninitialized r. That can trigger out_free_vram_pages to drop all VRAM just set up. Initialize r and only call the last svm_migrate_copy_memory_gart if j > 0. Current code postponed the last page to the final copy. This patch flushes on the last page when reach to the end of current drm_buddy_block; avoids another svm_migrate_copy_memory_gart. Cc: stable@vger.kernel.org Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdkfd: Fix error path at svm_migrate_copy_to_ramXiaogang Chen
If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated system pages. To do that driver should use page physical address, or pfn, then get struct page*. Current driver uses dma address(for adev) that is not correct with IOMMU enabled, or even in general. The patch releases and unlocks allocated system pages based on where migration failed by struct page* of sys ram pages. Also dma_unmap correspodent system ram pages at error path. Cc: stable@vger.kernel.org Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Log details when failing to register HPD IRQTimur Kristóf
This should help diagnose HPD IRQ related issues in the future. Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260821215059.312868-2-timur.kristof@gmail.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCETimur Kristóf
After a refactor that landed in Linux 7.0, DC now crashes when it is initialized on GPUs that have a VGA or LVDS connector. This is because these connectors have no HPD so the hpd_gpio is NULL and therefore DC takes the code path meant for DCN 4.2+ which sets irq_source_hpd = 255 that causes the subsequent code to try to register the HPD interrupt, which fails, and causes a crash. This commit should be backported to Linux 7.0 and newer. Cc: stable@vger.kernel.org Cc: Dmytro Laktyushkin <dmytro.laktyushkin@amd.com> Cc: Roman Li <roman.li@amd.com> Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5490 Fixes: def3488eb0fd ("drm/amd/display: refactor HPD to increase flexibility") Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260821215059.312868-1-timur.kristof@gmail.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: clamp the isolation index for rings outside a partitionXiang Liu
adev->isolation[] has one slot per partition, but a ring that is not assigned to one keeps AMDGPU_XCP_NO_PARTITION, which is ~0, so indexing the array with it is out of bounds. SDMA submissions hit this on both the isolation enforcement and the VM flush path and trip UBSAN. Fall back to the first slot the way the cleaner shader path already does, and stop taking the address before the ring type check that makes it relevant. Cc: stable@vger.kernel.org Signed-off-by: Xiang Liu <xiang.liu@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdkfd: Reject zero-sized AQL queue allocations after size halvingSunday Clement
KFD_IOC_ALLOC_MEMORY_OF_GPU with flag KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM and size=1 triggers the AQL wraparound workaround (size >>= 1), reducing size to 0. The resulting zero passes through PAGE_ALIGN(0) = 0 without validation, bypassing the per-process VRAM quota check in reserve_mem_limit() (vram_used + 0 > vram_available is always false). The fix adds post-halving zero-size validation in the primary allocation path (amdgpu_amdkfd_gpuvm.c). The check happens after size halving but before reserve_mem_limit(), and uses err_alignment_size error path to properly clean up the allocated kgd_mem structure and mutex. Cc: stable@vger.kernel.org Signed-off-by: Sunday Clement <Sunday.Clement@amd.com> Reviewed-by: Alex Deucher <Alexander.Deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: Fix VCE 3 ring align_maskDavid Rosca
The largest frame is 20 dwords, so 0xf mask is too small. This was always wrong, but we were lucky with the VCE_CMD_END commands inserted after fence and vm_flush. Fixes: 8897ea8c761b ("drm/amdgpu: Implement insert_end for VCE 3") Cc: stable@vger.kernel.org Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: David Rosca <david.rosca@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/kfd: Add CU occupancy support to GFX12.1David Belanger
Port changes from GFX9 to GFX12.1 mostly as-is. Minor changes to register access code. Assisted-by: Claude:Sonnet 4.6 Signed-off-by: David Belanger <david.belanger@amd.com> Reviewed-by: Sreekant Somasekharan <Sreekant.Somasekharan@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/kfd: Add CU occupancy support to GFX12David Belanger
Port changes from GFX9 to GFX12 mostly as-is. Minor changes to register access code. Assisted-by: Claude:Sonnet-4-6 Signed-off-by: David Belanger <david.belanger@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Sreekant Somasekharan <Sreekant.Somasekharan@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/kfd: Add CU occupancy support to GFX11David Belanger
Port changes from GFX9 to GFX11 mostly as-is. Minor changes to register access code. Assisted-by: Claude:Sonnet-4-6 Signed-off-by: David Belanger <david.belanger@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Sreekant Somasekharan <Sreekant.Somasekharan@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu: avoid force-completing uninitialized UVD ringsBob Zhou
uvd_v7_0_sw_init() does not initialize the UVD decode ring for an SR-IOV VF. However, amdgpu_uvd_resume() unconditionally force-completes the decode ring when restoring its fence sequence. Skip fence completion when the fence driver is not initialized. Fixes: 0a33b11d26c6 ("drm/amdgpu: mark force completed fences with -ECANCELED") Cc: stable@vger.kernel.org Signed-off-by: Bob Zhou <bobzhou2@amd.com> Acked-by: Leo Liu <leo.liu@amd.com> Acked-by: Frank Min <Frank.Min@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu/userq: lock and validate wptr BOs before reading their GPU offset ↵Jesse Zhang
on restore On resume, amdgpu_userq_vm_validate_and_restore_queue() updates each queue's wptr GPU address via amdgpu_bo_gpu_offset(). WPTR BOs are VM-mapped, but each BO has its own reservation object and is not implicitly covered by the VM validation path here. This can leave offset reads without proper BO locking/placement state and trigger WARN_ONs. ------------[ cut here ]------------ WARNING: amdgpu_object.c:1486 at amdgpu_bo_gpu_offset+0x75/0xa0 [amdgpu], CPU#3: kworker/3:1/116 Workqueue: events amdgpu_userq_restore_worker [amdgpu] RIP: 0010:amdgpu_bo_gpu_offset+0x75/0xa0 [amdgpu] Call Trace: <TASK> amdgpu_userq_vm_validate_and_restore_queue+0x629/0x960 [amdgpu] amdgpu_userq_restore_worker+0xa6/0x180 [amdgpu] process_scheduled_works+0xa6/0x460 worker_thread+0x13c/0x290 kthread+0xfb/0x140 ret_from_fork+0x1b6/0x2b0 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ WARNING: amdgpu_object.c:1485 at amdgpu_bo_gpu_offset+0x9a/0xa0 [amdgpu], CPU#2: kworker/2:1/127 Workqueue: events amdgpu_userq_restore_worker [amdgpu] RIP: 0010:amdgpu_bo_gpu_offset+0x9a/0xa0 [amdgpu] Add each queue's WPTR BO to the drm_exec ww context and validate it to its allowed placement before the later offset update. v2: - Clarify that WPTR BOs are VM-mapped (fix incorrect "not part of VM" wording). (Christian) - Describe both parts of the fix: lock BO reservations in drm_exec and validate BO placement before offset reads. Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/amdgpu/mes: fix the inconsistent indenting for mes_userq_map()Prike Liang
Fix the inconsistent indenting warning for mes_userq_map(). Fixes: d0827dda8fa7 ("drm/amdgpu/mes: refactor the amdgpu_mes_alloc/free_proc|gang()") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202608190252.8XCa0HqR-lkp@intel.com/ Signed-off-by: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-25drm/nouveau/dispnv50: program pixel clocks above 2.147GHz on GB20xMohamed Ahmed
The HEAD_SET_PIXEL_CLOCK_FREQUENCY(_MAX) methods carry only 31 HERTZ bits. Starting with C97D the upper bits live in separate HEAD_SET_PIXEL_CLOCK_FREQUENCY_HI(_MAX) methods, which nouveau never programmed and headca7d_mode() computed m->clock * 1000 into the 31-bit field. NVVAL's mask then silently truncates anything past 2^31 Hz, which means that every mode scanned out at pclk modulo 2^31. No mode nouveau can currently commit crosses the boundary (an uncompressed HDMI FRL mode tops out around 1.78GHz at 8bpc), but this is a prerequisite for the upcoming DSC work, which makes 2.147GHz+ modes reachable. Program the full value split across the low and HI methods, exactly as OpenRM's EvoSetRasterParams9() does (nvkms-evo4.c, 31-bit low word plus the 4 HI HERTZ bits, giving 35 bits of range). Signed-off-by: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260825001408.14219-10-mohamedahmedegypt2001@gmail.com
2026-08-25drm/nouveau/gsp: fix vblank interrupts on GB20xMohamed Ahmed
The GSP path programs per-head timing (vblank) interrupts the same way on every generation. NVD5.0 (GB20x) reworked the FE interrupt frontend around four message-based kernel vectors (high latency, low latency, PMU, and GSP) and moved RM head-timing interrupts to the dedicated low-latency vector: - The enable is NV_PDISP_FE_RM_INTR_EN1_HEAD_TIMING, 0x611ef0 + head*4 (570.144 kernel_head_0501.c, renamed kernel_head_0502.c from 575.51.02 on, and v05_01 dev_disp.h). - The vector is reported as a separate interrupt table entry, MC_ENGINE_IDX_DISP_LOW (intr_gb202.c, intrCacheDispIntrVectors). - The vector must be re-armed through NV_PDISP_FE_INTR_RETRIGGER(1) at 0x611f34 after servicing (kdispServiceInterrupt -> kdispIntrRetrigger_v05_01). The event latch (0x611800), per-head status (0x611c00), and dispatch summary (0x611ec0) the interrupt handler uses are unchanged on GB20x (kheadReadPendingVblank_v03_00 and kheadResetPendingLastData_v03_00 remain for DISPv0502+). On GB20x the old code enables head timing onto the legacy vector, leaves its handler there, and never re-arms the message-based vectors. Page flips still complete (nv50 sends those events from the commit path), so the desktop looks fine while DRM vblank waits and vblank sequence queries are affected. Supply GB20x vblank enables and an interrupt handler that re-arms the vector after servicing through gb202_gsp_disp, translate the low-latency interrupt table entry as a second NVKM_ENGINE_DISP instance, and add a gsp.intr_low_latency flag so r535_disp_oneinit() attaches the handler to that instance. GB20x was the last cross-file user of the TU1xx vblank enables, so make those static and drop their head.h prototypes. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Cc: stable@vger.kernel.org Signed-off-by: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260825001408.14219-9-mohamedahmedegypt2001@gmail.com
2026-08-25drm/nouveau/disp: fix head state readback on GB20xMohamed Ahmed
The GSP path reads armed head state and the RG scanout position through gv100_head_state() and gv100_head_rgpos() on every generation. gv100_head_state() reads the core channel's state mirror at a 0x400 per-head stride, which NVD5.0 (GB20x) doubled. Per NVIDIA's published CA7D class header every HEAD_SET method sits at 0x2000 + head * 0x800, while the mirror bases are unchanged (assembly at 0x680000, armed at +0x8000, per OpenRM's v03_00 channel-user-base HAL which is still used on DISPv0502). Add gb202_head_state(), the same readback at the 0x800 stride, and a gb202_gsp_head table to supply it. gv100_head_rgpos() is kept. The RG registers keep their per-head 0x800 stride on NVD5.0, and OpenRM's kdispReadRgLineCountAndFrameCount_v03_00 still reads NV_PDISP_RG_DPCA on DISPv0502. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Cc: stable@vger.kernel.org Signed-off-by: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260825001408.14219-8-mohamedahmedegypt2001@gmail.com
2026-08-25drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmwareMohamed Ahmed
NVIDIA removed the deprecated actualPclkHz/linkClkFreqHz fields and the whole Legacy{activeCnt, activeFrac, activePolarity, mvidWarEnabled, MvidWarParams} block from the SST sub-struct of NV0073_CTRL_CMD_DP_CONFIG_STREAM_PARAMS between the 535 and 570 releases (compared in OpenRM tags 535.113.01 vs 570.144), shrinking the struct. Everything nouveau writes sits at identical offsets in both layouts except the trailing SST.bEnableAudioOverRightPanel (written as zero), but the size is wrong on r570, which means r535_sor_dp_sst() and r535_sor_dp_vcpi() are sent with an incorrect size. Route the .sst/.vcpi IOR functions through nvkm_rm_api_disp the same way bl_ctrl and dp.get_caps/set_indexed_link_rates already are. Keep the existing implementation for r535 and add an r570 implementation built against the 570.144 layout, which already exists in r570/nvrm/disp.h but was unused until now. Also add the NV0073_CTRL_CMD_DP_CONFIG_STREAM define that was missing from the layout. Other DP controls sent through shared r535 code did not change layout between the tags. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Cc: stable@vger.kernel.org Signed-off-by: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260825001408.14219-7-mohamedahmedegypt2001@gmail.com
2026-08-25drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20xMohamed Ahmed
The GSP path brackets audio enablement with a General Control Packet AVMute toggle. r535_sor_hdmi_audio() calls the gsp.hdmi_gcp hook, which every chip so far serves with tu102_sor_hdmi_gcp() and the legacy GCP unit at 0x6f00c0/0x6f00cc. On GB20x the SF packet units were compacted and the old generic and VSI units are gone (ACR keeps slot 2) and the GCP unit moved from slot 3 to slot 1 (control 0x6f0040 and subpack 0x6f004c from NVIDIA's published clc971.h. The same offsets are also used by OpenRM's hdmiWriteGeneralCtrlPacketC871() on these chips). The old addresses are reserved on GB20x, so the AVMute writes were silent no-ops and mitigated only by the equivalent GCP r535_sor_hdmi_audio() already sends through the SET_OD_PACKET RM control. Add a GB20x GCP writer using the new offsets and hook it into gb202_gsp_disp, keeping the direct MMIO path in sync with the hardware as on earlier chips. Only SB0 (the AVMute bit) is written. On NVD5.0 the subpack register also carries SB1_CTRL (bit 24), which selects where the deep-color CD/PP fields are generated (hardware or from the driver, with the default being HW). hdmiWriteGeneralCtrlPacketC871() likewise writes only SB0-SB2. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Cc: stable@vger.kernel.org Signed-off-by: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260825001408.14219-6-mohamedahmedegypt2001@gmail.com
2026-08-25drm/nouveau/disp: fix HDMI vendor infoframes on GB20xMohamed Ahmed
The GSP path reuses the GV100 direct-MMIO infoframe writers on every chip. On GB20x that is only half right as while the legacy SF AVI unit is unchanged, the legacy VSI unit at 0x6f0100 was removed, so gv100_sor_hdmi_infoframe_vsi() writes into a reserved area and no vendor infoframe ever reaches the HW. This affects HDMI-VIC signalling which can impact some 4K modes for legacy HDMI 1.4 sinks. GB20x (NVDisplay 5.0+) reorganised the SF HDMI packet units. Per NVIDIA's published C971/CA71 DISP_SF_USER class headers, only three legacy units remain (AVI at +0x000, GCP at +0x040, ACR at +0x080), and vendor infoframes must instead be sent through the shared generic infoframe units at +0x130, whose 9-dword packet slots are loaded through the shared data port at +0x3f0/+0x3f4. Add a VSI writer using the same programming sequence OpenRM uses on these chips (nvhdmipkt_C971.c, programAdvancedInfoframeC971()): disable the unit and wait for it to idle, clear the SENT status, write the packet through the data port with a zero inserted in HB3 after the three header bytes, then enable the unit for every-frame transmission during vblank. Generic unit 1 is used for the VSI, matching the slot assignment in NVIDIA's nvkms (NVHDMIPKT_TYPE_SHARED_GENERIC2, unit 0 is reserved for extended metadata packets and unit 2 for the HDR DRM infoframe, if those are wired up later). GB20x so far shared GA10x's display entry point. Give it its own, gb202_disp_new(), with a gb202_gsp_disp table that supplies the VSI writer to the GSP path and otherwise carries the same hooks as GA10x. The following fixes fill in the rest of the GB20x differences there. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Cc: stable@vger.kernel.org Signed-off-by: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260825001408.14219-5-mohamedahmedegypt2001@gmail.com
2026-08-25drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooksMohamed Ahmed
The GSP-RM display code in rm/r535/disp.c borrows a few register-programming routines from engine/disp (the head-timing interrupt handler, vblank enables, armed head state and scanout position readback, the AVI/VSI infoframe writers and the GCP AVMute write) and so far picked them by name, which means it has to know which chip it runs on the moment a generation changes any of them. Give nvkm_disp_func a .gsp table that each chip fills with exactly those hooks, add tu102_gsp_disp (TU1xx) and ga102_gsp_disp (GA10x onwards) carrying the current functions, hand them to r535_disp_new() instead of the full hardware tables, and make rm/r535/disp.c call through the hooks. The head hooks are a whole nvkm_head_func, so r535_head goes away and the chip's own table is handed to nvkm_head_new_(). r535_sor_hdmi gets infoframe forwarders, r535_sor_hdmi_audio() calls the GCP hook, and the interrupt handler comes from the table. The tables are per chip even though the two currently coincide, so a generation that changes a hook only touches its own file. rm/r535/disp.c no longer contains chip-specific register code, and a new display generation only has to provide its own table. No functional change. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Cc: stable@vger.kernel.org Signed-off-by: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260825001408.14219-4-mohamedahmedegypt2001@gmail.com
2026-08-25drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/dispMohamed Ahmed
r535_sor_hdmi_audio() pairs two RM controls (a SET_OD_PACKET carrying the same General Control Packet, and the audio mute-stream toggle) with a direct write of the GCP AVMute bit through the SF GCP unit. The controls are RM and stay, but the direct write is register programming and moves next to the other per-chip display code as tu102_sor_hdmi_gcp(). No functional change. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Cc: stable@vger.kernel.org Signed-off-by: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260825001408.14219-3-mohamedahmedegypt2001@gmail.com
2026-08-25drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.cMohamed Ahmed
The GSP-RM display code in rm/r535/disp.c owns a handful of direct MMIO routines: the head-timing (vblank) interrupt handler and the per-head vblank enable/disable. They program display registers, not RM, so they belong with the rest of the per-chip register code in engine/disp/. Move them to tu102.c (Turing is the first GSP-capable generation) as tu102_disp_intr() and tu102_head_vblank_get()/put(), exported for rm/r535/disp.c, which keeps calling them by name for now. No functional change. Fixes: 6cc6e08d4542 ("drm/nouveau/kms: add support for GB20x") Cc: stable@vger.kernel.org Signed-off-by: Mohamed Ahmed <mohamedahmedegypt2001@gmail.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260825001408.14219-2-mohamedahmedegypt2001@gmail.com
2026-08-25drm/nouveau/disp/r535: Add scanline position support + head state supportLyude Paul
That's right! It looks like this never actually got finished, something which I just noticed today when I saw this fun message spamming one of my test machine's kernel logs when enabling display debug output for nouveau: [drm:drm_crtc_vblank_helper_get_vblank_timestamp_internal] crtc 0 : scanoutpos query failed. So it looks like we've been falling back to DRM's core fallback for a while now, whoops. So, while it seems that we do have the option of doing this through GSP - that doesn't seem like a great idea. Mainly because reading this from GSP would involve a lot more latency then we should have for vblank handling due to the RPC communication. So instead of implementing that, just use gv100_head_state and gv100_head_rgpos for implementing .state and .rgpos. It seems to work perfectly fine! Fixes: 9e9944449023 ("drm/nouveau/disp/r535: initial support") Cc: Ben Skeggs <bskeggs@redhat.com> Cc: Dave Airlie <airlied@redhat.com> Cc: Timur Tabi <ttabi@nvidia.com> Cc: Ben Skeggs <bskeggs@nvidia.com> Cc: James Jones <jajones@nvidia.com> Cc: Faith Ekstrand <faith.ekstrand@collabora.com> Cc: Suraj Kandpal <suraj.kandpal@intel.com> Cc: Lyude Paul <lyude@redhat.com> Cc: Aaron Kling <webgeek1234@gmail.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Zhang Enpei <zhang.enpei@zte.com.cn> Cc: <stable@vger.kernel.org> # v6.7+ Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260429030348.3930866-1-lyude@redhat.com (cherry picked from commit 804cb093b245c752f15d17186e0d404f10303593) Signed-off-by: Lyude Paul <lyude@redhat.com>
2026-08-25headers: Remove pagemap.h from swap.hMatthew Wilcox (Oracle)
swap.h does not need pagemap.h itself, and only three files were relying on pagemap.h being implicitly included by swap.h. This does not significantly reduce the number of files depending on pagemap.h, but it does reduce the entanglement of our headers a little. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
2026-08-25drm/amd: Remove pagemap.h includesMatthew Wilcox (Oracle)
None of these files need pagemap.h. kfd_priv.h brings in pagemap.h indirectly through swap.h, but fortunately it doesn't need swap.h either. amdgpu_ttm.c needs highmem.h for kmap/kunmap, but doesn't need all of pagemap.h. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
2026-08-25headers: Remove swap.h from suspend.hMatthew Wilcox (Oracle)
Nothing in suspend.h needs swap.h. However, many files indirectly depend on some of swap.h's dependencies, so this is a large cross-subsystem patch. Stats: 42 are missing includes of interrupt.h (the question of why swap.h brings in interrupt.h remains unanswered). 10 missing includes of seq_file.h 5 missing includes of swap.h (obviously all files could have just added swap.h, but I preferred to bring in a more minimal inclusion set) 3 missing includes of highmem.h 2 missing includes of device.h 2 missing includes of string_choices.h 1 missing include of cacheflush.h 1 missing include of dma-direction.h 1 missing include of kthread.h 1 missing include of pagemap.h 1 missing include of string_helpers.h 1 missing include of writeback.h I tried to follow whatever conventions appeared to be in use for the various subsystems I touched; for example I added string_choices.h to drm_print.h instead of individually to each driver which used the functions declared there. Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
2026-08-25drm/panthor: Take reqs_lock in soft_reset for clearing pending_reqsNicolas Frattaroli
panthor_gpu_soft_reset() sets pending_reqs to 0 without taking the requisite reqs_lock. Fix this by taking the lock for the duration of the modification. Fixes: 5cd894e258c4 ("drm/panthor: Add the GPU logical block") Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260812-panthor-cache-flush-fix-v4-3-751e32901898@collabora.com
2026-08-25drm/panthor: Revisit reqs_lock handling in flush/reset pathsNicolas Frattaroli
panthor_gpu_flush_caches() and panthor_gpu_soft_reset() acquire their reqs_lock spinlock with the IRQ-disabling variants of the spinlocking functions. This isn't necessary, as the lock is never taken from an atomic context, as Panthor uses threaded interrupt handlers. The result of this overly strict locking is that IRQs may be disabled more frequently and for longer than they should be, resulting in increased system latency. Switch the locking to use non-IRQ-disabling scoped_guard statements for locking. The wait_event_timeout read of pending_reqs outside of the spinlock is fine as wait_event_timeout is a memory barrier according to the Linux Memory Model. Fixes: 5cd894e258c4 ("drm/panthor: Add the GPU logical block") Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260812-panthor-cache-flush-fix-v4-2-751e32901898@collabora.com
2026-08-25drm/panthor: Add tracepoint for cache flushingNicolas Frattaroli
Add a new event tracepoint: gpu_cache_flush to be emitted after a GPU cache flush completes, with duration and return status arguments. This allows debugging the duration a flush takes irrespective of initial function entry lock contention, and communicates information about whether the flush timed out or errored out in other ways, and which caches were flushed. Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260812-panthor-cache-flush-fix-v4-1-751e32901898@collabora.com