summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-08-14drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()Dan Carpenter
Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drm_mode_addfb2(). Return an error pointer instead. Fixes: dc5698e80cf7 ("Add virtio gpu driver.") Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Link: https://patch.msgid.link/an1tWfHIHwtXd9SO@stanley.mountain
2026-08-14Merge tag 'drm-xe-next-fixes-2026-08-13' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Couple drm-ras fixes, a probe failure clean-up fix, a GT freq boundaries fixes for BMG/CRI and a Media engines/slice fix. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/an4NGzsYN9MOTFII@intel.com
2026-08-14Merge tag 'drm-misc-next-fixes-2026-08-13' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next A single patch to remove a .orig file introduced by accident. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260813-shrewd-ocelot-of-research-aa3caa@houat
2026-08-14drm/panel: samsung-s6d16d0: Use mipi_dsi_*_multi(); fix minor bugsAkash Sukhavasi
The mipi_dsi_dcs_*() functions used by this driver are deprecated in favour of their _multi() counterparts, as noted in Documentation/gpu/todo.rst. The _multi() variants record the first error in a context structure and skip subsequent calls once an error is set, removing the need to check the return value after each command. They also log failures internally, making the per-call dev_err() calls redundant. Convert prepare(), enable(), disable(), and unprepare() to use mipi_dsi_dcs_*_multi(). unprepare() previously returned an error if mipi_dsi_dcs_enter_sleep_mode() failed, skipping RESET assertion and regulator_disable(). Because drm_panel_unprepare() does not clear panel->prepared when the callback returns an error, drm_panel_prepare() would then return early on the next call, leaving the panel powered and unable to be re-initialised. The converted code always asserts RESET, disables the regulator, and returns 0. Also fix a typo in a comment ("Enabe" -> "Enable"). Signed-off-by: Akash Sukhavasi <akash.sukhavasi@gmail.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Linus Walleij <linusw@kernel.org> Link: https://patch.msgid.link/20260810-mipi-dsi-s6d16d0-multi-v2-1-8fcdfbf9bbd2@gmail.com
2026-08-14Merge tag 'drm-xe-fixes-2026-08-13' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix DPT Allocation paths (Maarten) - Fixes around UM queue BO (Jia) - Order ring writes before ring tail updates (Matthew Brost) - Add termination on resume for PXP (Daniele) - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra) - Fix sync entry leak on OA config emit failure (Linmao Li) - Check managed mutex initilization errors (Linmao Li) - Fix min frequency setting (Vinay) - Fix xe_device_probe error path (Raag) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/an4ZogmPqP2Xtfx3@fedora
2026-08-14Merge tag 'drm-misc-fixes-2026-08-13' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v7.3: - Revert fair scheduler patches and mark fair policy as experimental due to reported regressions. - Fix OOB read in connector/hdmi infoframe. - Handle invalid scaling parameters and empty messages in log target. - Skip attempting to populate unmapped pages in amdxdna. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/a9b38792-bdd0-42da-a46a-7a048c26c0c2@linux.intel.com
2026-08-13drm/xe/hwmon: Enable package and vram temperatures for CRIKarthik Poosa
Enable package and vram temperatures support from hwmon on CRI. The required MMIO offsets of these are same as on BMG. Signed-off-by: Karthik Poosa <karthik.poosa@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260813193546.511093-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-13drm/display: hdmi-state-helper: Init SCDC debugfs for HDMINicolas Frattaroli
Initialise the SCDC debugfs file for connectors that call the HDMI state helper's debugfs_init helper. This makes all connectors that use the helper expose the scdc_status file in their connector debugfs. Acked-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Link: https://patch.msgid.link/20260724-scdc-link-health-v9-5-bdda406d016d@collabora.com Signed-off-by: Daniel Stone <daniels@collabora.com>
2026-08-13drm/debugfs: Move HDMI debugfs registration to state helperNicolas Frattaroli
The HDMI debugfs files are only useful for connectors that already make use of the HDMI state helpers. In addition, relying on HDMI-specific functions in drm_debugfs.c can lead to circular linking problems later down the line. Move hdmi_debugfs_add() and friends to a new helper in drm_hdmi_state_helper.c, and make all current users (vc4, sun4i, bridge) either use it as a debugfs_init func, or call it directly in its debugfs_init func. Suggested-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Acked-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Link: https://patch.msgid.link/20260724-scdc-link-health-v9-4-bdda406d016d@collabora.com Signed-off-by: Daniel Stone <daniels@collabora.com>
2026-08-13drm/scdc-helper: Implement parsing and printing HDMI 2.1 fieldsNicolas Frattaroli
HDMI 2.1 redefines previously reserved fields in SCDC for various new uses. No version check needs to be performed, as an HDMI 2.0 sink's reserved SCDC fields are well-defined to be 0, and any zero-ness of these fields for an HDMI 2.0 sink is not a surprise for SCDC parsers for HDMI 2.1. Implement reading and outputting these fields over debugfs. Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Link: https://patch.msgid.link/20260724-scdc-link-health-v9-3-bdda406d016d@collabora.com Signed-off-by: Daniel Stone <daniels@collabora.com>
2026-08-13drm/scdc-helper: Add scdc_status debugfs entryNicolas Frattaroli
SCDC provides status information on the current display link. At the very least, it may be useful to expose this info through debugfs. Add a debugfs entry for it under the connector, which displays a few more details parsed out of the SCDC registers. A new drm_scdc_debugfs_init function can be called by the connector implementation to initialise the debugfs file. Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Reviewed-by: Daniel Stone <daniels@collabora.com> Acked-by: Maxime Ripard <mripard@kernel.org> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Link: https://patch.msgid.link/20260724-scdc-link-health-v9-2-bdda406d016d@collabora.com Signed-off-by: Daniel Stone <daniels@collabora.com>
2026-08-13drm/scdc-helper: Don't use ssize_t return type for scdc_read/writeNicolas Frattaroli
drm_scdc_read and drm_scdc_write, both of which are only used within drm_scdc_helper (although exported), use a ssize_t as their return type. This would make sense if they returned the number of bytes read/written on success, and negative errno otherwise. However, they return 0 on success. Demote them to "int" as their return type, in order to avoid needlessly using 64 bits when less suffices. No functional change. Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Reviewed-by: Hans Verkuil <hverkuil+cisco@kernel.org> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Tested-by: Hans Verkuil <hverkuil+cisco@kernel.org> Link: https://patch.msgid.link/20260724-scdc-link-health-v9-1-bdda406d016d@collabora.com Signed-off-by: Daniel Stone <daniels@collabora.com>
2026-08-13drm/log: Batch vmap/vunmap and flush for record drawingShixiong Ou
drm_log_draw_new_line() calls drm_log_clear_line() and drm_log_draw_line(), which independently call drm_client_buffer_vmap_local(), drm_client_buffer_vunmap_local(), and drm_client_buffer_flush(). For each call to drm_log_draw_new_line(), this results in 2 vmap/vunmap pairs and 2 flush calls, even though vmap_local maps the entire framebuffer each time. Refactor drm_log_clear_line() and drm_log_draw_line() to accept a pre-mapped iosys_map by value, removing the per-line vmap/vunmap/flush calls. Move the single vmap/vunmap pair and flush up to drm_log_draw_new_line(), which now maps once before clearing and drawing, then issues a single flush after unmapping. Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn> Link: https://patch.msgid.link/20260729084823.693723-1-oushixiong1025@163.com Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
2026-08-13drm/log: Fix infinite loop when scale is too large for displayShixiong Ou
When scale is large enough that scaled_font exceeds the display dimensions, rows or columns become 0. A columns value of 0 causes an infinite loop in drm_log_draw_kmsg_record() because the loop never decrements len. Check for zero rows/columns in drm_log_setup_modeset() and return an error, cleaning up the already allocated buffer to avoid a leak. Fixes: 8a4b913df427 ("drm/log: Add integer scaling support") Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260729084815.692944-1-oushixiong1025@163.com Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
2026-08-13drm/log: Fix out-of-bounds read on empty message lengthShixiong Ou
drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read. Add an early return when len is 0. Fixes: 25e2c2a3eff5 ("drm/log: Color the timestamp, to improve readability") Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260729084520.688087-1-oushixiong1025@163.com Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
2026-08-13drm/log: Fix division by zero when scale module parameter is 0Shixiong Ou
The scale module parameter can be set to 0 via kernel command line. When scale is 0, scaled_font_h and scaled_font_w become 0, causing a division by zero in the rows/columns calculation. Since the scale module parameter is read-only (0444 permissions), it cannot be changed at runtime via sysfs. Clamp it to 1 once in drm_log_register(). Fixes: 8a4b913df427 ("drm/log: Add integer scaling support") Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Link: https://patch.msgid.link/20260730014440.66323-1-oushixiong1025@163.com Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
2026-08-13drm/xe/ras: Use fault-inject to trigger cold-reset wedgeMallesh Koujalagi
Use the fault-inject framework to trigger the cold-reset wedge path (punit_error_handler()) for testing the wedge/recovery flow. Usage: echo 100 > .../wedge_cold_reset/probability echo 1 > .../wedge_cold_reset/times Signed-off-by: Mallesh Koujalagi <mallesh.koujalagi@intel.com> Reviewed-by: Raag Jadav <raag.jadav@intel.com> Link: https://patch.msgid.link/20260805071152.1225416-10-mallesh.koujalagi@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-13drm/xe: Handle PUNIT errors by requesting cold-reset recoveryMallesh Koujalagi
When PUNIT (power management unit) errors are detected that persist across warm resets, mark the device as wedged with DRM_WEDGE_RECOVERY_COLD_RESET and notify userspace that a complete device power cycle is required to restore normal operation. Signed-off-by: Mallesh Koujalagi <mallesh.koujalagi@intel.com> Reviewed-by: Raag Jadav <raag.jadav@intel.com> Link: https://patch.msgid.link/20260805071152.1225416-9-mallesh.koujalagi@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-13drm: Add DRM_WEDGE_RECOVERY_COLD_RESET recovery methodMallesh Koujalagi
Introduce DRM_WEDGE_RECOVERY_COLD_RESET (BIT(4)) recovery method to handle scenarios requiring device power cycle. This method addresses cases where other recovery mechanisms (driver reload, PCIe reset, etc.) are insufficient to restore device functionality. When set, it indicates to userspace that only device power cycle can recover the device from its current error state. Signed-off-by: Mallesh Koujalagi <mallesh.koujalagi@intel.com> Reviewed-by: Raag Jadav <raag.jadav@intel.com> Link: https://patch.msgid.link/20260805071152.1225416-7-mallesh.koujalagi@intel.com Acked-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-13drm/xe: tests: fix error message in xe_migrate_sanity_test()Dan Carpenter
This is supposed to print the error code but there is a copy and paste bug so it prints "bo" instead of "err". Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Dan Carpenter <error27@gmail.com> Link: https://patch.msgid.link/an1tu0z3T-qX1ogn@stanley.mountain Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-13drm/bridge: ti-sn65dsi83: Simplify error condition logicWojciech Dubowik
Simplify error condition logic in lvds device tree property parsing. It makes it easier to add extra properties without handling complex goto entries. Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@mt.com> Link: https://patch.msgid.link/20260728122032.692482-2-wojciech.dubowik@mt.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-08-13drm/xe/mcr: Take vcs1/vecs1 into account for first media sliceAshutosh Dixit
vcs1 and vecs1 may also be present on the first media slice, so take vcs1/vecs1 also into account when determining if the first media slice is absent. Bspec: 67103, 77977 Cc: Gustavo Sousa <gustavo.sousa@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260729230645.3052178-2-ashutosh.dixit@intel.com (cherry picked from commit 1dff677209f6ed48779f4ac2ba130a207540a435) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-13drm/xe: Fix xe_device_probe() failureRaag Jadav
Currently, xe_device_probe() jumps to err_unregister_display label in case of failure except for its last call, which directly returns the error without required cleanup handling. This results in stale drm device that isn't cleaned up on unwind. Fix it. [ 810.194180] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/drm/renderD128' [ 810.194183] CPU: 9 UID: 0 PID: 5616 Comm: modprobe Kdump: loaded Tainted: G S U E 7.2.0-rc2-xe #382 PREEMPT(full) [ 810.194185] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER, [E]=UNSIGNED_MODULE [ 810.194186] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 1805 10/30/2024 [ 810.194186] Call Trace: [ 810.194187] <TASK> [ 810.194188] dump_stack_lvl+0xe0/0x100 [ 810.194195] dump_stack+0x14/0x20 [ 810.194197] sysfs_warn_dup+0x5f/0x80 [ 810.194204] sysfs_create_dir_ns+0xbe/0xd0 [ 810.194210] kobject_add_internal+0xbc/0x2b0 [ 810.194215] kobject_add+0x7c/0xe0 [ 810.194220] ? get_device_parent+0xcf/0x1e0 [ 810.194227] device_add+0xe3/0x870 [ 810.194231] ? __pfx_drm_gem_name_info+0x10/0x10 [drm] [ 810.194280] drm_minor_register+0x73/0x130 [drm] [ 810.194322] drm_dev_register+0x76/0x2a0 [drm] Cc: stable@vger.kernel.org Fixes: da3799c97572 ("drm/xe: Use GuC to do GGTT invalidations for the GuC firmware") Signed-off-by: Raag Jadav <raag.jadav@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260810123821.105605-1-raag.jadav@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit 5ce3042c67c539480882567137ff8d56118885d6) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe: Fix a bug in pc_adjust_freq_bounds()Vinay Belgaumkar
In cases where min frequency was actually greater than BMG_MIN_FREQ, we were not using the updated min frequency as there was a missing call to pc_action_query_task_state() between the two settings of min frequency. Since we know what min_freq was last set, use that cached value while comparing to BMG_MIN_FREQ to fix this issue. v2: pc->freq_ready is not set until after pc_adjust_freq_bounds(). Stay with pc_action_query_task_state() instead. v3: Update commit message (Stuart) Fixes: bdde16c9ac5c ("drm/xe/bmg: Update Wa_14022085890") Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com> Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com> Reviewed-by: Stuart Summers <stuart.summers@intel.com> Link: https://patch.msgid.link/20260805234649.2076384-1-vinay.belgaumkar@intel.com (cherry picked from commit a2c2d2b13a9ea9494d2d76b46273833111749507) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe/oa: Check managed mutex initialization errorsLinmao Li
drmm_mutex_init() can fail while registering its managed cleanup action. On failure, the reset path destroys the mutex, so continuing OA setup leaves an unusable lock that later paths may acquire. Return the error from per-GT OA initialization and abort device-wide OA initialization if the metrics lock cannot be initialized. Fixes: a9f905ae7b6f ("drm/xe/oa/uapi: Initialize OA units") Fixes: cdf02fe1a94a ("drm/xe/oa/uapi: Add/remove OA config perf ops") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Link: https://patch.msgid.link/20260713083053.321091-1-lilinmao@kylinos.cn (cherry picked from commit 360b293de27bfdd0d07047f8efd5ba8e91fa90b7) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe/oa: Fix sync entry leak on OA config emit failureLinmao Li
xe_oa_emit_oa_config() releases the sync entries and the syncs array only on its success path. When it fails before the point of no return (fence allocation, config buffer allocation or batch submission), it returns without touching stream->syncs. The stream open path handles such failures in the caller, but xe_oa_config_locked() propagates the error without any cleanup, so the syncs array and the fence references held by the parsed entries are leaked. The next config ioctl overwrites stream->syncs, making the memory unreachable for good. Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching the cleanup done by the stream open error path. Fixes: 9920c8b88c5c ("drm/xe/oa: Add syncs support to OA config ioctl") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Link: https://patch.msgid.link/20260731011932.3426219-1-lilinmao@kylinos.cn (cherry picked from commit 8af97b3da2cfce04e6b457c6eb17ed3c1daf912b) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safeGajendra Uttamchand
Problem: CTX_TIMESTAMP MMIO reads could be stale if a context switched out between check and read; LRC stores a sentinel while a context starts that must not be treated as a real timestamp. Fix: Check the LRC-stored sentinel before and after the MMIO read; return the LRC value if the context switched out to avoid TOCTOU. Note: Keep XE_LRC_CTX_TIMESTAMP_ACTIVE in xe_lrc.h as the canonical sentinel. Fixes: d243ef6a39c6 ("drm/xe/lrc: Refactor xe_lrc_timestamp to simplify logic") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7956 Assisted-by: GitHub-Copilot:claude-sonnet-5 Signed-off-by: Gajendra Uttamchand <gajendra.uttamchand@intel.com> Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Acked-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Link: https://patch.msgid.link/20260810071812.213358-4-gajendra.uttamchand@intel.com (cherry picked from commit a806534474df071a730d930df479976a812b699d) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe/pxp: add termination on resumeDaniele Ceraolo Spurio
Suspend/resume causes the PXP keys to become invalid, but doesn't actually kill the session. The driver also doesn't explicitly kill and re-start the session until a new PXP request comes in, which means that the "zombie" session can potentially stick around if there are no new requests from userspace. While this is not an issue for PXP, HDCP has a new behavior starting on PTL where a communication is sent to GSC if a session is active at suspend time (even if it doesn't have a valid key), which can lead to delays in the suspend flow if we suspend while the zombie session is still active. To avoid this, we can trigger a termination on resume and kill the zombie session immediately, instead of delaying the termination to the next PXP request. Due to restrictions in the rpm suspend/resume flow, we can't call the termination flow from within the resume call itself, so the pxp irq worker is expanded to cover this scenario. The existing logic in the worker doesn't work as-is for the new flow, because the pm_get_if_active will fail if the worker runs before the pci_resume call has completed (which is possible, since we queue it from within that call) or after we're started to suspend again. Given that we always want to run the worker after a resume (differently from the irq case, where we want to skip if we're suspended), we can solve this by just taking the PM reference before queueing the worker. As part of this rework, the pxp->events variable has been moved to atomic, to avoid having to take xe->irq.lock from non-irq related paths. Fixes: b1dcec9bd8a1 ("drm/xe/ptl: Enable PXP for PTL") Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Julia Filipchuk <julia.filipchuk@intel.com> Cc: Alan Previn <alan.previn.teres.alexis@intel.com> Reviewed-by: Alan Previn <alan.previn.teres.alexis@intel.com> Link: https://patch.msgid.link/20260720222757.3876338-2-daniele.ceraolospurio@intel.com (cherry picked from commit 757bda2b8b93fa36ad9b2c7993081d5f9d0d6e3b) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe: Order ring writes before ring tail updatesMatthew Brost
The ring buffer and the LRC context image are both mapped WC, so the ring tail update can become visible to the device before the ring contents it is meant to publish. The GuC CT send does contain an xe_device_wmb(), so sending the H2G would flush the ring contents. The problem is that it comes too late: xe_lrc_set_ring_tail() publishes the tail before the H2G is sent, and the device samples the tail from the context image independently of it, either at context switch-in or while the context is already resident. A submitter which is interrupted between updating the tail and sending its H2G therefore leaves the device free to observe the new tail while the ring contents behind it are not yet visible: 1. Thread A emits a job into the ring, sets the tail to T_A and sends the H2G, which flushes A's ring contents. The GuC starts scheduling the context in, but it is not executing yet. 2. Thread B emits a job into ring[T_A..T_B]. Those writes are not yet visible to the device. 3. Thread B updates the ring tail to T_B. That write targets a different page and becomes visible first. 4. Thread B is interrupted before it sends its H2G, so the flush which would have published ring[T_A..T_B] has not happened yet. 5. The context is switched in and samples the ring tail from the context image, picking up T_B rather than T_A. 6. The GPU executes A's job, advances HEAD to T_A, and continues on to ring[T_A..T_B], which still holds the previous wrap's contents, so the CS parses stale commands. The result is command stream corruption, which typically manifests as a hang or a spurious pagefault rather than anything that points back at the submission path. Kernel jobs are by far the most likely to hit this. Kernel queues such as the migration queue are shared and can be driven by many threads concurrently, producing back-to-back submissions on an LRC which is already executing. User queues are typically tied to a single submitting thread, so the same interleaving is much harder to produce. Add an xe_device_wmb() at the end of xe_lrc_write_ring() so that it covers every ring tail publication site, and so the invariant is local: once xe_lrc_write_ring() returns, the ring contents are visible to the device. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8651 Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7810 Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost@intel.com> Assisted-by: GitHub_Copilot:claude-opus-5 Reviewed-by: Stuart Summers <stuart.summers@intel.com> Link: https://patch.msgid.link/20260807171716.140475-1-matthew.brost@intel.com (cherry picked from commit 136360290f314890428a3fbf31aaa8e4f1d43567) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe/guc_ads: use uncached mapping for UM queue BOJia Yao
On Pre-Xe3p platform, the GAM write the UM queue through DPA using UC. if GuC reads the queue via GGTT (WB), stale data may be observed when the cacheline has been polluted by another agent. To match the GAM's UC writes, configure the GuC mapping as UC as well. Fixes: 9c57bc08652a ("drm/xe/lnl: Drop force_probe requirement") Cc: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: <stable@vger.kernel.org> # v6.12+ Signed-off-by: Jia Yao <jia.yao@intel.com> Reviewed by: Matthew Auld <matthew.auld@intel.com> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260804165057.129529-4-jia.yao@intel.com (cherry picked from commit 9daa302a82590eeee7bdc68023ddad302df4b88c) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe/guc_ads: allocate UM queues in VRAM on dGFXJia Yao
On iGPU, the UM queue BO is allocated in system memory. On dGFX, the BO was previously created in system memory and later reallocated in xe_guc_realloc_post_hwconfig(). Allocate the UM queue BO directly in VRAM on dGFX, where it is ultimately required. Fixes: 9c57bc08652a ("drm/xe/lnl: Drop force_probe requirement") Cc: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: <stable@vger.kernel.org> # v6.12+ Signed-off-by: Jia Yao <jia.yao@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260804165057.129529-3-jia.yao@intel.com (cherry picked from commit ace076ef0a854ab5940bacc539bf66afd61d118c) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe/guc_ads: allocate UM queues in a separate BOJia Yao
Move the UM queues into a dedicated BO (ads->um_queue_bo) and avoid CPU memset operations on it, which eliminates the CPU as a potential cacheline-polluting agent and helps maintain consistency between GAM writes and GuC reads. We also need to ensure the base_dpa for the queue is contiguous on hw where this is used instead of a GGTT address. Another good reason to split this out to a separate BO. Fixes: 9c57bc08652a ("drm/xe/lnl: Drop force_probe requirement") Cc: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: <stable@vger.kernel.org> # v6.12+ Signed-off-by: Jia Yao <jia.yao@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260804165057.129529-2-jia.yao@intel.com (cherry picked from commit 6af05de0dc19bbf3aaeec2020fe48b37c834b811) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe: Fix DPT allocation paths.Maarten Lankhorst
Remove the fallback for VRAM to system memory, I tested it and that doesn't work at all, only a black screen with pipe fault errors were observed. On systems with media GT, extra latency is added when accessing stolen memory when the GT is in MC6. Since we additionally aren't counting how much memory is used for stolen and we could in theory fill up the entire stolen area with DPT's, avoid using stolen and only use the default memory region. Using stolen may also result in random system hangs under load. Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7513 Fixes: 775d0adc01a5 ("drm/xe/fbdev: Limit the usage of stolen for LNL+") Cc: <stable@vger.kernel.org> # v6.12+ Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260630135523.1775379-2-dev@lankhorst.se Signed-off-by: Maarten Lankhorst <dev@lankhorst.se> Acked-by: Matthew Brost <matthew.brost@intel.com> #teams (cherry picked from commit a196406a3831291598fe8e73245914f7acffdfe0) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13drm/xe: Fix a bug in pc_adjust_freq_bounds()Vinay Belgaumkar
In cases where min frequency was actually greater than BMG_MIN_FREQ, we were not using the updated min frequency as there was a missing call to pc_action_query_task_state() between the two settings of min frequency. Since we know what min_freq was last set, use that cached value while comparing to BMG_MIN_FREQ to fix this issue. v2: pc->freq_ready is not set until after pc_adjust_freq_bounds(). Stay with pc_action_query_task_state() instead. v3: Update commit message (Stuart) Fixes: bdde16c9ac5c ("drm/xe/bmg: Update Wa_14022085890") Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com> Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com> Reviewed-by: Stuart Summers <stuart.summers@intel.com> Link: https://patch.msgid.link/20260805234649.2076384-1-vinay.belgaumkar@intel.com (cherry picked from commit a2c2d2b13a9ea9494d2d76b46273833111749507) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-13drm/xe: Fix xe_device_probe() failureRaag Jadav
Currently, xe_device_probe() jumps to err_unregister_display label in case of failure except for its last call, which directly returns the error without required cleanup handling. This results in stale drm device that isn't cleaned up on unwind. Fix it. [ 810.194180] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/drm/renderD128' [ 810.194183] CPU: 9 UID: 0 PID: 5616 Comm: modprobe Kdump: loaded Tainted: G S U E 7.2.0-rc2-xe #382 PREEMPT(full) [ 810.194185] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER, [E]=UNSIGNED_MODULE [ 810.194186] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 1805 10/30/2024 [ 810.194186] Call Trace: [ 810.194187] <TASK> [ 810.194188] dump_stack_lvl+0xe0/0x100 [ 810.194195] dump_stack+0x14/0x20 [ 810.194197] sysfs_warn_dup+0x5f/0x80 [ 810.194204] sysfs_create_dir_ns+0xbe/0xd0 [ 810.194210] kobject_add_internal+0xbc/0x2b0 [ 810.194215] kobject_add+0x7c/0xe0 [ 810.194220] ? get_device_parent+0xcf/0x1e0 [ 810.194227] device_add+0xe3/0x870 [ 810.194231] ? __pfx_drm_gem_name_info+0x10/0x10 [drm] [ 810.194280] drm_minor_register+0x73/0x130 [drm] [ 810.194322] drm_dev_register+0x76/0x2a0 [drm] Cc: stable@vger.kernel.org Fixes: da3799c97572 ("drm/xe: Use GuC to do GGTT invalidations for the GuC firmware") Signed-off-by: Raag Jadav <raag.jadav@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260810123821.105605-1-raag.jadav@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit 5ce3042c67c539480882567137ff8d56118885d6) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-13drm/xe/drm_ras: Move has_drm_ras check to drm_ras layerRaag Jadav
has_drm_ras flag is meant to facilitate drm_ras feature. Move it to the correct layer where it belongs. Fixes: 63dfab5786ca ("drm/xe/xe_ras: Add drm_ras feature flag") Signed-off-by: Raag Jadav <raag.jadav@intel.com> Reviewed-by: Riana Tauro <riana.tauro@intel.com> Link: https://patch.msgid.link/20260810124101.105832-1-raag.jadav@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit 9f15135fe2dd9cff3caccab2f6ff4df86804b3c2) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-13drm/xe/ras: Fix boot-time ras error processingRaag Jadav
Currently, we xe_ras_process_errors() inside xe_ras_init() to handle boot time errors. But this can potentially result in declaring the device as wedged quite early in the driver load sequence, which is problematic due to the lack of registered drm device or required wedged cleanup hooks at this point. Call xe_ras_process_errors() only after the prerequisites are available. Fixes: d9732e498f5f ("drm/xe/xe_ras: Query errors from system controller on probe") Signed-off-by: Raag Jadav <raag.jadav@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Tested-by: Mallesh Koujalagi <mallesh.koujalagi@intel.com> Link: https://patch.msgid.link/20260730110635.925537-1-raag.jadav@intel.com Signed-off-by: Riana Tauro <riana.tauro@intel.com> (cherry picked from commit 20bc4883c7c0e28c3ba6c76ccc279486c349dd3e) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-13drm/i915/display: remove unnecessary PHY_NONE definitionLuca Coelho
PHY_NONE is not really used, but we define it and, thus, need to check for it in a few places we use phy. The only potential places where phy may become PHY_NONE, is in intel_port_to_phy(), where it derives from port, which can be PORT_NONE. Many of its callers don't check for PHY_NONE, which can cause unknown behavior. Additionally, this can only happen if the encoder used has PORT_NONE, which should not be the case either, without unexpected consequences. Remove the PHY_NONE definition entirely and add a couple of WARNs at the relevant places, just to be sure. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/20260609095525.570614-5-luciano.coelho@intel.com Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2026-08-13drm/i915/display: harden shift in intel_ddi_compute_config_late()Luca Coelho
BIT() takes a non-negative shift amount, but cpu_transcoder is of type enum transcoder, which can in theory be INVALID_TRANSCODER (-1). This is not a problem with the current implementation, because cpu_transcoder is always valid when this code is reached, but it's more robust to cast to unsigned so the shift is always well-defined. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/20260609095525.570614-4-luciano.coelho@intel.com Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2026-08-13drm/i915/display: harden shifts in ICL_DPCLKA_CFGCR0_DDI_CLK_SEL macrosLuca Coelho
ICL_DPCLKA_CFGCR0 has a 2-bit DDI_CLK_SEL field per combo PHY, for PHY_A..PHY_D only. Any other phy value (PHY_NONE, TypeC/SNPS PHYs) is not valid here. This is not a problem with the current implementation, because phy is always valid when these macros are called, but it's more robust to cast to unsigned so the shift is always well-defined. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/20260609095525.570614-3-luciano.coelho@intel.com Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2026-08-13drm/i915/display: harden masks in HSW_AUD_PIN_ELD_CP_VLD macrosLuca Coelho
HSW_AUD_PIN_ELD_CP_VLD has a 4-bit field per transcoder for TRANSCODER_A..TRANSCODER_D only (bits 0..15). Any other transcoder value (TRANSCODER_EDP, TRANSCODER_DSI_*, INVALID_TRANSCODER) is not valid here. This is not a problem with the current implementation, because trans is always valid when these macros are called, but it's more robust to mask the index to the low 2 bits so the shift is always well-defined. Reviewed-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/20260609095525.570614-2-luciano.coelho@intel.com Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
2026-08-13drm/bridge: ti-sn65dsi83: Remove redundant dev_err_probe()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err_probe() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260723131649.134127-10-panchuang@vivo.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-08-13drm/bridge/sii8620: Remove redundant dev_err_probe()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err_probe() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260723131649.134127-9-panchuang@vivo.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-08-13drm/bridge: it6505: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260723131649.134127-8-panchuang@vivo.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-08-13drm/bridge: tc358767: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260723131649.134127-7-panchuang@vivo.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-08-13drm/bridge: synopsys: dw-dp: Remove redundant dev_err_probe()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err_probe() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260723131649.134127-6-panchuang@vivo.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-08-13drm/bridge: samsung-dsim: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260723131649.134127-5-panchuang@vivo.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-08-13drm/bridge: lt9611: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260723131649.134127-4-panchuang@vivo.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-08-13drm/bridge: cdns-mhdp8546: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260723131649.134127-3-panchuang@vivo.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-08-13drm/bridge: analogix_dp: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() call. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Damon Ding <damon.ding@rock-chips.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260723131649.134127-2-panchuang@vivo.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-21 14:25:05 +0000