summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-08-10drm/amd/display: Clean up FreeSync capability detectionAlex Huang
Many duplicate codes can be extracted to common code, fill amdgpu_dm_connector fields outside of the DP/eDP, HDMI branches, pull the VSDB data once using get_amd_vsdb() and then derive the refresh rate ranges. When a monitor advertises support for FreeSync, the refresh rate from the AMD VSDB is used, otherwise, falls back on the monitor_range, either EDID refresh rate range field or DisplayID VRR data. Signed-off-by: Alex Huang <Alex.Huang2@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260804143339.714548-4-Alex.Huang2@amd.com (Adjust for movement to amdgpu_dm_connector.c) Signed-off-by: Mario Limonciello <superm1@kernel.org>
2026-08-10drm/amd/display: Use HDMI FreeSync range from common EDID parserAlex Huang
HDMI FreeSync on amdgpu is detected using the AMD VSDB parser in the DMUB firmware, now that the common DRM EDID parser can do the same, use the common parser. Extend get_amd_vsdb() to copy the relevant flags and data now being extracted from the AMD VSDB. Additionally, parse_hdmi_amd_vsdb() and the parse_edid_cea() firmware helpers now have no callers; remove them. Signed-off-by: Alex Huang <Alex.Huang2@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260804143339.714548-3-Alex.Huang2@amd.com (Adjust for movement to amdgpu_dm_connector.c) Signed-off-by: Mario Limonciello <superm1@kernel.org>
2026-08-10drm/edid: Parse AMD VSDB for FreeSync refresh rangeAlex Huang
Commit 118362a96286 ("drm/edid: Parse AMD Vendor-Specific Data Block") added parsing of the AMD VSDB, but only for version 3 and only for the replay/panel-type/luminance fields. Monitors that only advertise FreeSync through a v1 or v2 AMD VSDB therefore get no variable refresh rate range from the common EDID parser. Restructure drm_parse_amd_vsdb() and implement parsing for the FreeSync refresh range fields provided in the AMD VSDB. Additionally, version > 3 will be parsed as if they were version 3 (with a warning of this occurring) as future versions will likely be backwards compatible. Signed-off-by: Alex Huang <Alex.Huang2@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260804143339.714548-2-Alex.Huang2@amd.com Signed-off-by: Mario Limonciello <superm1@kernel.org>
2026-08-10drm/xe/oa: Fix sync entry leak on OA config emit failureLinmao Li
xe_oa_emit_oa_config() releases the sync entries and the syncs array only on its success path. When it fails before the point of no return (fence allocation, config buffer allocation or batch submission), it returns without touching stream->syncs. The stream open path handles such failures in the caller, but xe_oa_config_locked() propagates the error without any cleanup, so the syncs array and the fence references held by the parsed entries are leaked. The next config ioctl overwrites stream->syncs, making the memory unreachable for good. Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching the cleanup done by the stream open error path. Fixes: 9920c8b88c5c ("drm/xe/oa: Add syncs support to OA config ioctl") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Link: https://patch.msgid.link/20260731011932.3426219-1-lilinmao@kylinos.cn
2026-08-10drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safeGajendra Uttamchand
Problem: CTX_TIMESTAMP MMIO reads could be stale if a context switched out between check and read; LRC stores a sentinel while a context starts that must not be treated as a real timestamp. Fix: Check the LRC-stored sentinel before and after the MMIO read; return the LRC value if the context switched out to avoid TOCTOU. Note: Keep XE_LRC_CTX_TIMESTAMP_ACTIVE in xe_lrc.h as the canonical sentinel. Fixes: d243ef6a39c6 ("drm/xe/lrc: Refactor xe_lrc_timestamp to simplify logic") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7956 Assisted-by: GitHub-Copilot:claude-sonnet-5 Signed-off-by: Gajendra Uttamchand <gajendra.uttamchand@intel.com> Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Acked-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Link: https://patch.msgid.link/20260810071812.213358-4-gajendra.uttamchand@intel.com
2026-08-10drm/xe/drm_ras: Move has_drm_ras check to drm_ras layerRaag Jadav
has_drm_ras flag is meant to facilitate drm_ras feature. Move it to the correct layer where it belongs. Fixes: 63dfab5786ca ("drm/xe/xe_ras: Add drm_ras feature flag") Signed-off-by: Raag Jadav <raag.jadav@intel.com> Reviewed-by: Riana Tauro <riana.tauro@intel.com> Link: https://patch.msgid.link/20260810124101.105832-1-raag.jadav@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-08-10drm/xe/pxp: add termination on resumeDaniele Ceraolo Spurio
Suspend/resume causes the PXP keys to become invalid, but doesn't actually kill the session. The driver also doesn't explicitly kill and re-start the session until a new PXP request comes in, which means that the "zombie" session can potentially stick around if there are no new requests from userspace. While this is not an issue for PXP, HDCP has a new behavior starting on PTL where a communication is sent to GSC if a session is active at suspend time (even if it doesn't have a valid key), which can lead to delays in the suspend flow if we suspend while the zombie session is still active. To avoid this, we can trigger a termination on resume and kill the zombie session immediately, instead of delaying the termination to the next PXP request. Due to restrictions in the rpm suspend/resume flow, we can't call the termination flow from within the resume call itself, so the pxp irq worker is expanded to cover this scenario. The existing logic in the worker doesn't work as-is for the new flow, because the pm_get_if_active will fail if the worker runs before the pci_resume call has completed (which is possible, since we queue it from within that call) or after we're started to suspend again. Given that we always want to run the worker after a resume (differently from the irq case, where we want to skip if we're suspended), we can solve this by just taking the PM reference before queueing the worker. As part of this rework, the pxp->events variable has been moved to atomic, to avoid having to take xe->irq.lock from non-irq related paths. Fixes: b1dcec9bd8a1 ("drm/xe/ptl: Enable PXP for PTL") Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Julia Filipchuk <julia.filipchuk@intel.com> Cc: Alan Previn <alan.previn.teres.alexis@intel.com> Reviewed-by: Alan Previn <alan.previn.teres.alexis@intel.com> Link: https://patch.msgid.link/20260720222757.3876338-2-daniele.ceraolospurio@intel.com
2026-08-10drm/i915/debugfs: Reject invalid force_joined_pipes harderJani Nikula
Reject invalid joiner forcing more thoroughly, taking into account whether bigjoiner or uncompressed joiner is available, and whether the requested number of pipes can actually be joined. Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/df39b8f30d27a441465b4d9bd42d4db982e5db2b.1786105831.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-08-10drm/i915/dp: Limit compute config joining to pipes that can actually joinJani Nikula
Skip joining for pipes that can't work as joiner primary pipe for the number of pipes being joined. This limits the invalid combos early, instead of ending up with crtc_state->joiner_pipes that would fail during modeset. Before, crtc_state->joiner pipes could have ended up including pipes that do not exist on the platform. Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/dc1c7fc45d4da7d3fd1bd8b94c30c78d69aa0742.1786105831.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-08-10drm/i915/dp: Limit for_each_joiner_candidate() on joiner pipes availableJani Nikula
Make intel_dp_can_join(), and subsequently intel_dp_joiner_candidate_valid() and for_each_joiner_candidate() more strict about pipes actually available for joining by using intel_joiner_valid_primary_pipe_mask(). This rejects some invalid combos early for both mode enumeration and compute config. Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/efc330687f8299e5725564c3ed90d5d8e6aa0eb2.1786105831.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-08-10drm/i915/display: Limit max joined dotclock on joiner pipes availableJani Nikula
Multiplying the max dotclock based on joiner availability on the platform alone does not take into account the actual pipes (possibly with some fused) available for joining. Limit the max joined dotclock based on the actual pipes available for joining. Add helpers for figuring out the valid primary pipes, based on having the required joiners and amount of consecutive pipes available. v2: Check for consecutive pipes available (Ankit) Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/3c615440f018af779a3a522f14637d2993f7af03.1786105831.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-08-10Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixesMaarten Lankhorst
Pull in v7.2-rc7. Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-08-10drm/connector/hdmi: Fix out of bounds memory readJohn Harrison
A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 28 byte allocation. Fix that by using the source size instead, together with a build bug on the source size actually being smaller than the destination. I hit this running KUnit tests under KASAN (while debugging something else entirely). In the real world, it seems unlikely to cause an actual problem. It is a read not a write so it can't corrupt any memory. However, it could potentially fall off the end of a page and cause an accvio bug. Fixes: f378b77227bc ("drm/connector: hdmi: Add Infoframes generation") Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Cc: Maxime Ripard <mripard@kernel.org> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: David Airlie <airlied@gmail.com> Cc: Simona Vetter <simona@ffwll.ch> Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Cc: Daniel Stone <daniel@fooishbar.org> Cc: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: José Expósito <jose.exposito89@gmail.com> Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com> Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v6.11+ Signed-off-by: John Harrison <John.Harrison@Igalia.com> Link: https://patch.msgid.link/20260723220652.533345-1-John.Harrison@Igalia.com Signed-off-by: Maxime Ripard <mripard@kernel.org>
2026-08-10drm/xe/pf: Add _locked variant of the doorbells bulk config functionMichal Wajdeczko
We will soon want to provision all VFs, including their GuC doorbell IDs config, in one step. Split existing doorbells bulk configuration function into two functions, one of which will expect the master lock to be already taken. Use this new function in the fair GuC doorbells provisioning. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Reviewed-by: Satyanarayana K V P <satyanarayana.k.v.p@intel.com> Link: https://patch.msgid.link/20260807164826.5650-1-michal.wajdeczko@intel.com
2026-08-10drm/xe/pf: Add _locked variant of the contexts bulk config functionMichal Wajdeczko
We will soon want to provision all VFs, including their GuC context IDs config, in one step. Split existing GuC IDs bulk configuration function into two functions, one of which will expect the master lock to be already taken. Use this new function in the fair GuC IDs provisioning. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com> Link: https://patch.msgid.link/20260805154733.604-3-michal.wajdeczko@intel.com
2026-08-10drm/xe/pf: Add _locked variant of the GGTT bulk config functionMichal Wajdeczko
We will soon want to provision all VFs, including their GGTT config, in one step. Split existing GGTT bulk configuration function into two functions, one of which will expect the master lock to be already taken. Use this new function in the fair GGTT provisioning. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com> Link: https://patch.msgid.link/20260805154733.604-2-michal.wajdeczko@intel.com
2026-08-10Merge tag 'drm-rust-next-2026-08-08' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/rust/kernel into drm-next DRM Rust changes for v7.3-rc1 - I/O (shared from driver-core tree via signed tag rust-io-7.3-rc1): - Rework of I/O types: make I/O regions typed (with a dynamically-sized Region type for the existing untyped case), create view types representing subregions of a mapped I/O region, and add io_project!() for safely creating subviews. - Split Io into a base trait (IoBase) and an extension trait (Io) with a blanket implementation, preventing implementers from overriding provided methods that unsafe code relies on. - Add a SysMem backend for shared system memory with volatile access, and make Coherent implement Io via an I/O view type. Add copying methods (memcpy_{from,to}io). - Replace dma_read!/dma_write! with io_read!/io_write!; drop the old macros. - DRM: - RegistrationGuard and RegistrationData: - Rework DeviceContext typestates: rename Uninit to Normal, add an Ioctl context, restrict AlwaysRefCounted to Normal for both Device and GEM Object, and establish a Deref chain from Registered to Normal. - Introduce RegistrationGuard, a guard representing a drm_dev_enter/exit SRCU critical section that proves the DRM device is registered, which implies the parent bus device is still bound. - Add RegistrationData as a GAT on drm::Driver. The data does not outlive driver unbind, so it can capture lifetime-annotated device resources and references. Accessible through the guard via a closure with HRTB lifetime. - Wrap ioctl dispatch in RegistrationGuard (returning ENODEV if unplugged) and pass registration data to handlers. - Add Driver::ParentDevice associated type. - Fix unbounded lifetimes in ioctl handler arguments. - Fix a race in drm_dev_register() where a partial failure allowed in-flight ioctls to proceed while the error path tore down resources. - GEM shmem: add DmaResvGuard helper, vmap functions, and sg_table() accessor. - GPUVM: require Send + Sync for the driver's associated data, implement Send and Sync for GpuVaAlloc and GpuVmBo, add SmContext lifetime bound, update DriverGpuVm for DeviceContext. - Nova: - nova-core / nova-drm cross-crate dependency: - Build nova-core and nova-drm from drivers/gpu/Makefile for build ordering, export nova-core Rust symbols for nova-drm. Workaround until the build system supports Rust cross-crate dependencies natively. - GSP boot process consolidation: - Introduce GspBootContext to bundle common boot parameters, replacing per-argument threading. Separate context and GPU lifetimes to support mutable borrows of GPU subdevices. - Turn FWSEC execution into a HAL method, make FWSEC bootloader usage a property of the TU102 HAL (GA102+ gets its own instance with it disabled). Move firmware file selection to the GSP HAL. - Store the Fsp instance in Gpu (lifetime tied to the GPU, not just a single boot invocation). Move GSP state and unload bundle into a pinned subobject for reliable teardown on partial init failure. - Boot GSP with vGPU enabled: - Add PRC (Product Reconfiguration Control) protocol to query device configuration from the FSP. Read vGPU mode, detect and store vGPU state. - Set RMSetSriovMode registry entry and reserve the larger WPR2 heap required when vGPU is enabled. - Build SetRegistry entries dynamically. - TLV firmware image format: - Add a TLV (type-length-value) parser for the new firmware image format. TLV files use unversioned filenames with a .tlv suffix, start with "NVFW" magic, and contain tagged blocks with 4-byte aligned payloads. - Transition all firmware loading (booter, gsp, gen_bootloader, fsp) to TLV images. - Note: this requires a development firmware not in linux-firmware [1]; this is temporary and serves the transition to r615. - Hopper/Blackwell fixes and cleanups: - Correct FRTS vidmem offset calculation, split FbLayout into FSP and non-FSP versions, fix Blackwell flush address composition, use absolute FBHUB0 flush registers on Blackwell, use correct sysmem flush registers on Hopper. - Harden FSP messaging: limit receive allocation size, catch bogus queue pointers, ensure DMA allocation lifetimes for FMC boot and LibOS, wait for RISC-V HALTED on unload. - I/O projection adoption: - Use io_project!() for PTE array, message queues, and Falcon DMA transfer bounds checking. - Misc: - Keep unloading if FWSEC-SB fails during Turing/Ampere GSP reset. - Don't declare booter firmware for FSP chipsets. - Fix packed registry table size. - Extract and display usable FB regions from GSP. - Store bar and dev directly in Falcon, simplifying the API. - Parse VBIOS structs via zerocopy. - Convert to kernel bitfield macro, remove local one. - Move register definitions into sub-modules. - Add FSP and PRC protocol documentation. - Tyr: - Firmware loading and MCU boot: - Add a generic slot manager for dynamically allocating limited hardware slots to software seats, with lazy eviction under contention. - Add MMU support wrapping the slot manager for address-space slot allocation, with MAIR-to-MEMATTR translation. - Add GPU virtual memory (VM) support using drm_gpuvm with ARM64 LPAE Stage 1 page tables and 4KB/2MB page sizes. - Add a kernel buffer object type for internal driver allocations. - Add a parser for the Mali CSF firmware binary format. - Add MCU booting: load, parse, and map firmware sections into VM, then boot the MCU at probe(). - Cross-subsystem: - Add faux::Device type with AsBusDevice support. Allow retrieving a bound Device from a Registration. - Add device lifetime to IoPageTable. - Add Vec::zeroed method. - Add firmware::request_into_buf() to load firmware into a caller-provided buffer. - Rename dma_handle to dma_address in the DMA abstraction. - Change pci_sriov_get_totalvfs() return type to unsigned int; add Rust helper. [1] https://github.com/ttabi/linux-firmware-nova Signed-off-by: Dave Airlie <airlied@redhat.com> From: "Danilo Krummrich" <dakr@kernel.org> Link: https://patch.msgid.link/DKJQQUOS0PVO.3JPR3MYK4PDVZ@kernel.org
2026-08-10Merge tag 'pin-init-v7.3' of https://github.com/Rust-for-Linux/linux into ↵Miguel Ojeda
rust-next Pull pin-init updates from Gary Guo: "User-visible changes: - Merge the '__pinned_init' and '__init' methods and make 'Init' a marker trait. - Introduce public APIs 'raw_init' and 'raw_try_init' to prevent users from needing to invoke the internal '__pinned_init'/'__init' methods. - Emit errors for duplicate '#[pin]' attributes. - Link 'Zeroable::zeroed' and 'pin_init::zeroed' in documentation. Other changes: - Fix unwind safety issues. - Clean up lint 'allow' and 'expect's. - Overhaul '#[cfg]' handling to pave the way for tuple structs and self-referential structs. - Mark many functions as '#[inline]' for better codegen with '-C opt-level=s' ('CC_OPTIMIZE_FOR_SIZE')." * tag 'pin-init-v7.3' of https://github.com/Rust-for-Linux/linux: rust: pin-init: add `#[inline]` to small functions rust: pin-init: remove `__pinned_init` method for `cfg(kernel)` rust: treewide: replace `__pinned_init` with `raw_[try_]init` rust: pin-init: add `raw_init` and `raw_try_init` and recommend over `__init` rust: pin-init: merge `__pinned_init` and `__init` rust: pin-init: examples: use `Wrapper::pin_init` instead of manual reimplementation rust: pin-init: mark `pin_init::zeroed` and `Zeroable::zeroed` as `#[inline]` rust: pin-init: docs: link `Zeroable::zeroed` and `pin_init::zeroed` in documentation rust: pin-init: internal: rework how `#[pin_data]` handles cfg rust: pin-init: make `[pin_]chain` unwind safe rust: pin-init: make `[pin_]init_array_from_fn` unwind safe rust: pin-init: internal: generate brace in macro for init code blocks rust: pin-init: internal: remove `allow` and `expect`s that don't fire rust: pin-init: remove redundant clippy expects in doc tests rust: pin-init: examples: fix incorrect drop rust: pin-init: internal: error on duplicate `#[pin]` attribute
2026-08-10Merge tag 'v7.2-rc7' into driver-core-nextDanilo Krummrich
We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-08Merge tag 'drm-misc-next-2026-08-06' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.3: UAPI Changes: - Remove the default udmabuf size limit of 64MB. Cross-subsystem Changes: - Add dmemcg support for eviction, and hook it up for amdgpu and xe. Core Changes: - Changes to TTM to be more aggressive when allocating below protection limit! - Improve dt binding documentation for renesas. - Add helper to convert physical address back to buddy block, add that to and improve its kunit test. Driver Changes: - Assorted small fixes to ti-sn65dsi86, panthor, imagination, omapdrm, bridge/synopsys, panel-edp, ssd130x, panel/tdo-tl070wsh30. - Add Sharp LQ120P1JX51 panel. - Add dmemcg support to nouveau. - Various updates and improvements to sun4i, among which YUV and 4k support. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/917d462a-8976-4a15-bec4-4513ec51c5c0@linux.intel.com
2026-08-07drm/xe: Order ring writes before ring tail updatesMatthew Brost
The ring buffer and the LRC context image are both mapped WC, so the ring tail update can become visible to the device before the ring contents it is meant to publish. The GuC CT send does contain an xe_device_wmb(), so sending the H2G would flush the ring contents. The problem is that it comes too late: xe_lrc_set_ring_tail() publishes the tail before the H2G is sent, and the device samples the tail from the context image independently of it, either at context switch-in or while the context is already resident. A submitter which is interrupted between updating the tail and sending its H2G therefore leaves the device free to observe the new tail while the ring contents behind it are not yet visible: 1. Thread A emits a job into the ring, sets the tail to T_A and sends the H2G, which flushes A's ring contents. The GuC starts scheduling the context in, but it is not executing yet. 2. Thread B emits a job into ring[T_A..T_B]. Those writes are not yet visible to the device. 3. Thread B updates the ring tail to T_B. That write targets a different page and becomes visible first. 4. Thread B is interrupted before it sends its H2G, so the flush which would have published ring[T_A..T_B] has not happened yet. 5. The context is switched in and samples the ring tail from the context image, picking up T_B rather than T_A. 6. The GPU executes A's job, advances HEAD to T_A, and continues on to ring[T_A..T_B], which still holds the previous wrap's contents, so the CS parses stale commands. The result is command stream corruption, which typically manifests as a hang or a spurious pagefault rather than anything that points back at the submission path. Kernel jobs are by far the most likely to hit this. Kernel queues such as the migration queue are shared and can be driven by many threads concurrently, producing back-to-back submissions on an LRC which is already executing. User queues are typically tied to a single submitting thread, so the same interleaving is much harder to produce. Add an xe_device_wmb() at the end of xe_lrc_write_ring() so that it covers every ring tail publication site, and so the invariant is local: once xe_lrc_write_ring() returns, the ring contents are visible to the device. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8651 Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7810 Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost@intel.com> Assisted-by: GitHub_Copilot:claude-opus-5 Reviewed-by: Stuart Summers <stuart.summers@intel.com> Link: https://patch.msgid.link/20260807171716.140475-1-matthew.brost@intel.com
2026-08-08Merge tag 'amd-drm-next-7.3-2026-08-06' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-7.3-2026-08-06: amdgpu: - JPEG queue reset fixes - GC 12 fix - GMC 12.1 fixes - Lockdep false positive fix - Userq fixes - Bounds checking fixes - Devcoredump fixes - DCN 2.0.1 fix - Aperture mapping fix - DC avmute fix - DC self refresh fix - RAS updates - SMU 15 updates - SMU PPT updates - SMU 14 fixes - Initial DCN 6.0.0 support - GC 6 soft reset rework - Display bounds checking fixes - FRL fixes - VRR fixes - More display KUnit tests - Refactor DC stream validation - DCN 3.5.1 fixes - DCN 3.2 fixes - DC CRC fixes - MES 12.0 fixes amdkfd: - SVM fixes - MES updates radeon: - Performance regression fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260806213106.994528-1-alexander.deucher@amd.com
2026-08-07drm/xe: Track parallel page fault activity in GT statsMatthew Brost
Add a new GT statistic, PARALLEL_PAGEFAULT_COUNT, to record when multiple page fault workers are active concurrently. When a worker dequeues a fault, scan peer workers for an active cache entry and increment the counter if another fault is already in flight. This provides basic visibility into parallel fault handling behavior for performance analysis and tuning. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maciej Patelczyk <maciej.patelczyk@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-13-matthew.brost@intel.com
2026-08-07drm/xe: batch CT pagefault acks with periodic flushMatthew Brost
Pagefault storms can generate long chains of acknowledgments back to the GuC. Sending each ack as a full CT submission forces a barrier, descriptor update and doorbell per fault. Extend xe_guc_ct_send_locked() with a “defer-flush” mode that copies the message into the H2G ring but defers publishing the descriptor and ringing the doorbell. Add xe_guc_ct_send_flush() to publish pending writes and notify GuC once per batch. Wire this into the pagefault producer via new ack_fault_begin/ack_fault_end callbacks and CT lock wrappers. To avoid excessive flush latency while still amortizing MMIO costs, use a simple periodic flush heuristic for GuC pagefault acks: batch most acks as defer-flush and force a publish at a fixed interval (e.g., every 16th ack), with a final flush at end-of-batch. Also increase the H2G CTB size to 16K to better absorb bursts. Assisted-by: ChatGPT:gpt-5 # Documentation Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Francois Dugast <francois.dugast@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-12-matthew.brost@intel.com
2026-08-07drm/xe: Add debugfs pagefault_infoMatthew Brost
Add a debugfs entry to dump Xe page fault queue state. The output includes queue geometry (entry size, total size, head/tail), per-entry allocation state counts, and whether each page fault worker cache is currently valid. This is intended to help debug page fault storms, chaining, and retry behaviour without needing tracing. Assisted-by: ChatGPT:gpt-5 # Documentation Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maciej Patelczyk <maciej.patelczyk@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-11-matthew.brost@intel.com
2026-08-07drm/xe: Add pagefault chaining statsMatthew Brost
Add GT stats to quantify pagefault chaining behavior during fault storms. Track total chained faults, faults chained directly from the IRQ handler, cases where IRQ chaining also drained the queue, chained faults that had to be requeued due to range mismatch, and cases where the last serviced range allowed immediate ack. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maciej Patelczyk <maciej.patelczyk@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-10-matthew.brost@intel.com
2026-08-07drm/xe: Chain page faults via queue-resident cache to avoid fault stormsMatthew Brost
Some Xe platforms can generate pagefault storms where many faults target the same address range in a short time window (e.g. many EU threads faulting the same page). The current worker/locking model effectively serializes faults for a given range and repeatedly performs VMA/range lookups for each fault, which creates head-of-queue blocking and wastes CPU in the hot path. Introduce a page fault chaining cache that coalesces faults targeting the same ASID and address range. Each worker tracks the active fault range it is servicing. Fault entries reside in stable queue storage, allowing the IRQ handler to match new faults against the worker cache and directly chain cache hits onto the active entry without allocation or waiting for dequeue. Once the leading fault completes, the worker acknowledges the entire chain. A small allocation state is added to each entry so queue, worker, and IRQ paths can safely reference the same fault object. This prevents reuse while the fault is active and guarantees that chained faults remain valid until acknowledged. Fault handlers also record the serviced range so subsequent faults can be acknowledged without re-running the full resolution path. This removes repeated fault resolution during fault storms and significantly improves forward progress in SVM workloads. Since threaded prefetches now use a dedicated prefetch workqueue (usm.prefetch_wq) rather than sharing the page fault workqueue, page fault servicing can no longer deadlock on vm->lock, so this cache does not need an -EAGAIN retry path for a failed vm->lock acquisition. Assisted-by: ChatGPT:gpt-5 # Documentation Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Francois Dugast <francois.dugast@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-9-matthew.brost@intel.com
2026-08-07drm/xe: Track pagefault worker runtimeMatthew Brost
Add a GT stat measuring total time spent servicing pagefault workqueue iterations. The counter accumulates the runtime of the pagefault worker in microseconds, allowing correlation of fault storms and chaining behavior with CPU time spent in the fault handler. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maciej Patelczyk <maciej.patelczyk@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-8-matthew.brost@intel.com
2026-08-07drm/xe: Engine class and instance into a u8Matthew Brost
Pack the engine class and instance fields into a single u8 to save space in struct xe_pagefault. This also makes future extensions easier. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maciej Patelczyk <maciej.patelczyk@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-7-matthew.brost@intel.com
2026-08-07drm/xe: Add num_pf_work modparamMatthew Brost
Add a module parameter to control the number of page-fault work threads, making it easy to experiment with how different numbers of work threads impact performance. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maciej Patelczyk <maciej.patelczyk@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-6-matthew.brost@intel.com
2026-08-07drm/xe: Use a single page-fault queue with multiple workersMatthew Brost
With fine-grained page-fault locking, it no longer makes sense to maintain multiple page-fault queues, as we no longer hash queues based on the VM’s ASID. Multiple workers can pull page faults from a single queue, eliminating any head-of-queue blocking. Refactor the structures and code to use a single shared queue. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maciej Patelczyk <maciej.patelczyk@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-5-matthew.brost@intel.com
2026-08-07drm/xe: Thread prefetch of SVM rangesMatthew Brost
The migrate_vma_* functions are very CPU-intensive; as a result, prefetching SVM ranges is limited by CPU performance rather than paging copy engine bandwidth. To accelerate SVM range prefetching, the step that calls migrate_vma_* is now threaded. A dedicated prefetch workqueue is used for threading so prefetch work is never mixed with page fault or garbage collector work. Running xe_exec_system_allocator --r prefetch-benchmark, which tests 64MB prefetches, shows an increase from ~4.35 GB/s to 12.25 GB/s with this patch on drm-tip. Enabling high SLPC further increases throughput to ~15.25 GB/s, and combining SLPC with ULLS raises it to ~16 GB/s. Both of these optimizations are upcoming. Since the dedicated prefetch workqueue is not shared with page fault or SVM garbage collector work, page fault servicing and garbage collection can keep using a plain down_read() on vm->lock: there is no risk of a blocked reader starving a worker that a pending writer is waiting to flush, because that flushing is now confined to the separate prefetch workqueue. Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Francois Dugast <francois.dugast@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-4-matthew.brost@intel.com
2026-08-07drm/xe: Allow prefetch-only VM bind IOCTLs to use VM read lockMatthew Brost
Prefetch-only VM bind IOCTLs do not modify VMAs or use userptr pages. Downgrade vm->lock to read mode once setup is complete. Lays the groundwork for prefetch IOCTLs to use threaded migration. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Francois Dugast <francois.dugast@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-3-matthew.brost@intel.com
2026-08-07drm/xe: Fine grained page fault lockingMatthew Brost
Enable page faults to be serviced while holding vm->lock in read mode. Introduce additional locks to: - Ensure only one page fault thread services a given range or VMA - Serialize SVM garbage collection - Protect SVM range insertion and removal While these locks may contend during page faults, expensive operations like migration can now run in parallel within a single VM. In addition to new locking, ranges must be reference-counted after lookup, as another thread could immediately remove them from the GPU SVM tree, potentially dropping the last reference. Lastly, decouple the VM’s ASID from the page fault queue selection to allow parallel page fault handling within the same VM. Lays the groundwork for prefetch IOCTLs to use threaded migration too. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Link: https://patch.msgid.link/20260806185202.3922432-2-matthew.brost@intel.com
2026-08-07Merge drm/drm-next into drm-xe-nextMatthew Brost
Bring drm-xe-next up to date DRM GPU SVM changes. Signed-off-by: Matthew Brost <matthew.brost@intel.com>
2026-08-07drm/xe/hwmon: handle CRI+ power interval encodingKarthik Poosa
On CRI and newer platforms, the power-limit interval encoding is changed from the legacy 1.x * 2^y format to a U5.2 value in milliseconds. Update the interval calculation accordingly for CRI and future platforms. v2: Round the fractional bit to 1 for values greater than 0.5 ms in the show path, as the minimum supported time is 1 ms. No special handling is needed in the store path since sysfs inputs are only in milliseconds. (Badal) Signed-off-by: Karthik Poosa <karthik.poosa@intel.com> Reviewed-by: Badal Nilawar <badal.nilawar@intel.com> Link: https://patch.msgid.link/20260703153320.1368225-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-08-07drm/komeda: Set display/writeback clone masksVincenzo Frascino
Since commit 41b4b11da0215 ("drm: Add valid clones check"), all encoders attached to the same CRTC must advertise each other through possible_clones. Komeda creates one writeback connector per CRTC. Allow the writeback encoder to be cloned only with encoders that can drive the same CRTC, and update those encoders reciprocally. Signed-off-by: Asad Malik <asad.malik@arm.com> Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Co-developed-by: Raveendra Talabattula <raveendra.talabattula@arm.com> Signed-off-by: Raveendra Talabattula <raveendra.talabattula@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260803142122.4127851-3-raveendra.talabattula@arm.com
2026-08-07drm/komeda: Fix bits parsing of GLB_CORE_IDRaveendra Talabattula
GLB_CORE_ID contains the product and version information returned by the hardware. The current macros parses VERSION_MINOR as a 4-bit field and VERSION_STATUS as an 8-bit field, which does not match the register layout. As a result, the driver reports an incorrect version number. Fix the parsing macros to match the hardware specification: - VERSION_MINOR is 8 bits at [11:4] - VERSION_STATUS is 4 bits at [3:0] Fixes: bd628c1bed79 ("drm/komeda: komeda_dev/pipeline/component definition and initialzation") Signed-off-by: Raveendra Talabattula <raveendra.talabattula@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260803142122.4127851-2-raveendra.talabattula@arm.com
2026-08-07drm/i915/dp_mst: Remove duplicate intel_pfit_compute_config() callChaitanya Kumar Borah
mst_stream_compute_config() called intel_pfit_compute_config() twice in a row. commit 5ce9ac1531b8 ("drm/i915/mst: Call intel_pfit_compute_config() for sharpness filter") was erroneously cherry-picked to the fixes tree while commit ca97f5546f19 ("drm/i915/mst: Call intel_pfit_compute_config() for sharpness filter") was already in there. Drop the redundant duplicate call. Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: Nemesa Garg <nemesa.garg@intel.com> Cc: Jani Nikula <jani.nikula@linux.intel.com> Fixes: 5ce9ac1531b8 ("drm/i915/mst: Call intel_pfit_compute_config() for sharpness filter") Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Reviewed-by: Nemesa Garg <nemesa.garg@intel.com> Link: https://patch.msgid.link/20260806074819.2631970-1-chaitanya.kumar.borah@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> [Rodrigo: adjusted commit message]
2026-08-07Merge tag 'amd-drm-fixes-7.2-2026-08-06' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.2-2026-08-06: amdgpu: - JPEG queue reset fixes - GC 12 fix - GMC 12.1 fixes - Lockdep false positive fix - Userq fix - Bounds checking fixes - Devcoredump fixes - DCN 2.0.1 fix - Aperture mapping fix - DC avmute fix - DC self refresh fix radeon: - Performance regression fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260806211538.994087-1-alexander.deucher@amd.com
2026-08-07Merge tag 'drm-misc-fixes-2026-08-06' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v7.2-rc6: - panthor & shmem helpers: Check vma range inside pmd fault handler. - panthor: handle empty firmware sections correctly. - bridge/ps8640: Forward aux transfer errors. - amdxdna: Improve error handling in amdxdna_insert_pages. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/415659f6-5199-4078-8319-22d7529e777d@linux.intel.com
2026-08-06mm: introduce vma_get_page_prot() and use itLorenzo Stoakes
There's a large number of vm_get_page_prot(vma->vm_flags) invocations. Make life easier by introducing vma_get_page_prot() parameterised by the VMA. This also makes converting vm_get_page_prot() to vma_flags_t easier. Also update the userland VMA tests to reflect the change. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-8-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Acked-by: Zi Yan <ziy@nvidia.com> Acked-by: Jani Nikula <jani.nikula@intel.com> # for i915 Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> [DRM] Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06drm/amdgpu: Wire up dmem cgroup reclaim for VRAM managerThomas Hellström
Register the VRAM manager with the dmem cgroup reclaim infrastructure so that lowering dmem.max below current VRAM usage triggers TTM eviction rather than failing with -EBUSY. Guard place->flags in amdgpu_ttm_bo_eviction_valuable() against NULL, as the TTM reclaim path passes a NULL place in cgroup drain mode. Use drmm_cgroup_register_region() so that the region is automatically unregistered at DRM device release, after drm_dev_unplug() has already made drm_dev_enter() return false. The drm_dev_enter/exit guard in the reclaim callback ensures no reclaim work touches the TTM manager after driver unbind, closing the window between vram_mgr_fini() (called from drm_driver.release) and the drmm cleanup that unregisters the region. v3: - Rebased on fix for uninitialized list and buddy allocator on the drmm_cgroup_register_region() error path. v5: - Rebased on the introduction of struct dmem_cgroup_init. - Clear the reclaim callback in amdgpu_vram_mgr_fini() to prevent use-after-free if cgroup reclaim is triggered after driver unbind while userspace holds an open DRM file descriptor. (Sashiko-bot) - Switch from drmm_cgroup_register_region() to the raw dmem_cgroup_register_region() and store the region in amdgpu_vram_mgr.cg_region. Call dmem_cgroup_unregister_region() in amdgpu_vram_mgr_fini() after ttm_resource_manager_evict_all() to drain in-flight reclaim callbacks, and clear man->cg afterwards. This is required because amdgpu's vram manager fini is called explicitly during driver unbind, which may precede the DRM device release and thus precede any drmm-based cleanup. (Sashiko-bot) v6: - Fix mgr->cg_region never being assigned, so dmem_cgroup_unregister_region() in fini silently no-ops on NULL and leaks the region. (Sashiko-bot) - Reorder fini to call set_used(false) and evict_all() before dmem_cgroup_unregister_region(), so ttm_resource_free() can uncharge via man->cg during eviction; clear man->cg after unregister. (Sashiko-bot) v7: - Move dmem_cgroup_unregister_region() before the early return on evict_all() failure; not doing so leaves a dangling reclaim callback pointing to the partially-torn-down VRAM manager, causing a use-after-free when the cgroup later triggers reclaim. (Sashiko-bot) - Switch back to drmm_cgroup_register_region() with a drm_dev_enter/ exit guard in the reclaim callback (matching xe), rather than manual register/unregister. drm_dev_unplug() fires before vram_mgr_fini(), so drm_dev_enter() returning false prevents any reclaim from touching the manager during teardown. This also fixes the "vram" name collision on multi-GPU systems, since drmm_cgroup_register_region() automatically prefixes with "drm/<pci-addr>/". (Sashiko-bot) v8: - Move the dmem cgroup region teardown back into amdgpu_vram_mgr_fini(): register the region with dmem_cgroup_register_region() (keeping the "drm/<unique>/vram" prefix), store it in amdgpu_vram_mgr.cg_region, and unregister it explicitly after ttm_resource_manager_evict_all(). The v7 drmm-only approach left a use-after-free on the probe-error teardown path: drm_dev_unplug() is not called there, so the drm_dev_enter() guard stays open while drm_driver.release destroys the manager before the drmm action unregisters the region. The explicit unregister drains in-flight reclaim on every teardown path; the drm_dev_enter() guard is kept as defense against reclaim after unplug. (Sashiko-bot) v9: - Don't leak a gpu buddy manager on cgroup init failure. (Sashiko-bot) - Acquire a runtime PM reference (pm_runtime_get_sync/put_autosuspend) around the TTM reclaim call in amdgpu_vram_mgr_dmem_reclaim(). (Sashiko-bot) Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Tested-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Link: https://patch.msgid.link/20260725100036.2372-7-thomas.hellstrom@linux.intel.com Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-08-06drm/xe: Wire up dmem cgroup reclaim for VRAM managerThomas Hellström
Register the VRAM manager with the dmem cgroup reclaim infrastructure so that lowering dmem.max below current VRAM usage triggers TTM eviction rather than failing with -EBUSY. v4: - Rebased on drm-tip; dropped the XE_PL_STOLEN guard as stolen memory uses a separate TTM manager and never calls __xe_ttm_vram_mgr_init(). v5: - Rebased on the introduction of struct dmem_cgroup_init. - Register the fini drmm action before drmm_cgroup_register_region() so that devres LIFO teardown runs unregister_region() first (draining any in-flight reclaim callbacks via the rwsem) and xe_ttm_vram_mgr_fini() second, ensuring the manager is never accessed by a reclaim callback after teardown. (Sashiko-bot) - Wrap the reclaim callback in xe_ttm_vram_mgr_dmem_reclaim() using drm_dev_enter()/drm_dev_exit() to prevent TTM reclaim from running after driver unbind. v9: - Close ttm_resource_manager_set_used() races around vram manager init and fini. - Formatting fix. - Acquire a runtime PM reference around the TTM reclaim call in xe_ttm_vram_mgr_dmem_reclaim(). (Sashiko-bot) Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> #v8 Tested-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Link: https://patch.msgid.link/20260725100036.2372-6-thomas.hellstrom@linux.intel.com Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-08-06drm/ttm: Hook up a cgroup-aware reclaim callback for the dmem controllerThomas Hellström
Add ttm_bo_evict_cgroup() to evict buffer objects charged to a specific dmem cgroup pool from a resource manager's LRU until a byte target is met. Add ttm_resource_manager_set_dmem_region() to associate a dmem cgroup region with a resource manager; drivers supply their own dmem_cgroup_ops with ttm_resource_manager_dmem_reclaim as the reclaim function and the manager pointer as reclaim_priv in the dmem_cgroup_init to wire up TTM eviction as the reclaim callback. The eviction context is interruptible; signals abort the operation and propagate back through the write() syscall. Introduce a new mode for the bo LRU walker so that sleeping locks can be taken. This can be used when the caller doesn't hold any previous dma_resv locks, and where it intends to hold at most one lock at a time. Like the rest of the TTM eviction this should sooner than later be converted to full WW transactions. v3: - Fix ttm_resource_manager_set_dmem_region() storing an error pointer in man->cg unconditionally. (Sashiko-bot) - Fix kernel-doc function name format for ttm_bo_evict_cgroup() and ttm_resource_manager_set_dmem_region(). v5: - Rebased on the introduction of struct dmem_cgroup_init. - Handle NULL region in ttm_resource_manager_set_dmem_region() to clear the reclaim callback, preventing use-after-free when the manager is torn down while the dmem region outlives it. (Sashiko-bot) - Return 0 on any progress (even partial eviction), -ENOSPC only when nothing was freed; fixes callers that expected 0 on partial success. - Document that the reclaim callback should return 0 if some progress was made, -ENOSPC if no progress at all, or another error for fatal failures. v8: - Fix ttm_resource_manager_set_dmem_region() using IS_ERR_OR_NULL(), which skipped the assignment for a NULL region and thus never cleared man->cg. Use IS_ERR() so that a NULL region detaches the region as the kernel-doc and the v5 changelog intended. (Sashiko-bot) v9: - Don't leak cgroup charges for bos that may have survived dmemcg region fini. - Drop the misleading "Capture size before eviction in case res is cleared" comment in ttm_bo_evict_cb(). (Maarten Lankhorst) Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> #v7 Tested-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Link: https://patch.msgid.link/20260725100036.2372-5-thomas.hellstrom@linux.intel.com Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-08-06cgroup/dmem: Introduce struct dmem_cgroup_init for region initializationThomas Hellström
Replace the bare u64 size argument to dmem_cgroup_register_region() and drmm_cgroup_register_region() with a const struct dmem_cgroup_init * pointer. The struct currently carries only the size field, but using a struct makes the API extensible: future callers can supply additional initialization parameters without adding more positional arguments. Update all in-tree callers (amdgpu, xe) to use a compound-literal initializer. v5: - Commit introduced. Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Tested-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Link: https://patch.msgid.link/20260725100036.2372-3-thomas.hellstrom@linux.intel.com Acked-by: Dave Airlie <airlied@redhat.com> Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-08-06gpu: nova-core: falcon: use I/O projection to check transfer boundsAlexandre Courbot
The DMA transfer routine was computing the start of the DMA area by taking the address of the coherent allocation, and then adding the transfer's start offset. It then checked manually that the upper bound was valid. Convert this to an I/O projection of the same region, which returns `ERANGE` if the passed range does not fit within the coherent allocation. This removes the need to perform arithmetic on DMA addresses and to explicitly check for the bounds' validity. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260805-falcon-dma-projections-v2-3-4cc9f3f13ee9@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-06rust: dma: rename dma_handle to dma_addressAlexandre Courbot
The `dma_handle` naming is inherited from the C API, but what this really describes is the device DMA address; everything named `dma_handle` is actually a `dma_addr_t`. This naming introduces some confusion on the Rust API side, as handles are supposed to be opaque tokens, yet we were doing address computation on values returned by `dma_handle`. Rename `dma_handle` to `dma_address` while nova-core is still its only user. Suggested-by: John Hubbard <jhubbard@nvidia.com> Suggested-by: Danilo Krummrich <dakr@kernel.org> Link: https://lore.kernel.org/all/DK75LUA4NLGI.3P29AIZQE20V2@kernel.org/ Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Reviewed-by: Robin Murphy <robin.murphy@arm.com> Link: https://patch.msgid.link/20260805-falcon-dma-projections-v2-2-4cc9f3f13ee9@nvidia.com [ Rebase and fix up build failures due to newly introduced dma_handle() calls. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-06gpu: nova-core: falcon: remove unnecessary checkAlexandre Courbot
The `try_with_base` call performed on `NV_PFALCON_FALCON_DMATRFBASE1` already returns `EOVERFLOW` if the address is too large for the register, making this check redundant. Signed-off-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://patch.msgid.link/20260805-falcon-dma-projections-v2-1-4cc9f3f13ee9@nvidia.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-08-06drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init()Thomas Hellström
drmm_cgroup_register_region() is called before INIT_LIST_HEAD() and gpu_buddy_init() in amdgpu_vram_mgr_init(). If it fails, the function returns early and bypasses those initializations. Since adev->mman.initialized is set to true before amdgpu_vram_mgr_init() is called, a failure triggers amdgpu_ttm_fini(), which calls amdgpu_vram_mgr_fini(), which then: - Calls list_for_each_entry_safe() on reservations_pending and reserved_pages, whose list_head::next pointers are zero-initialized (NULL). The loop does not recognize them as empty and dereferences NULL. - Calls gpu_buddy_fini(), which iterates free_trees[] unconditionally via for_each_free_tree(). Since mm->free_trees is NULL (never allocated), this dereferences NULL. Both result in a kernel panic on the module load error path. Fix by moving drmm_cgroup_register_region() to after the list and buddy allocator are fully initialized, so the teardown path is safe to run. Reported-by: Sashiko-bot <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260428073116.15687-1-thomas.hellstrom@linux.intel.com?part=4 Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in TTM") Cc: Friedrich Vock <friedrich.vock@gmx.de> Cc: Maarten Lankhorst <dev@lankhorst.se> Cc: Tejun Heo <tj@kernel.org> Cc: Maxime Ripard <mripard@kernel.org> Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: amd-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v6.14+ Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com> Reviewed-By: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Tested-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Link: https://patch.msgid.link/20260725100036.2372-2-thomas.hellstrom@linux.intel.com Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-21 22:53:51 +0000