summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-04-03drm/amdgpu/vcn4: Prevent OOB reads when parsing IBBenjamin Cheng
Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the bounds checks. Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com> Acked-by: Christian König <christian.koenig@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2026-04-03drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msgBenjamin Cheng
Check bounds against the end of the BO whenever we access the msg. Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2026-04-03drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msgBenjamin Cheng
Check bounds against the end of the BO whenever we access the msg. Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2026-04-03drm/amdgpu/vce: Prevent partial address patchesBenjamin Cheng
In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW. Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2026-04-03drm/amdgpu: Add bounds checking to ib_{get,set}_valueBenjamin Cheng
The uvd/vce/vcn code accesses the IB at predefined offsets without checking that the IB is large enough. Check the bounds here. The caller is responsible for making sure it can handle arbitrary return values. Also make the idx a uint32_t to prevent overflows causing the condition to fail. Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org
2026-04-03drm/amd/display: Fix missing parameter details in amdgpu_dm_ismSrinivasan Shanmugam
Update comments in dm_ism_get_idle_allow_delay() and dm_ism_insert_record() to better reflect their behavior and inputs. dm_ism_get_idle_allow_delay() computes the delay before allowing idle optimizations based on history and stream timing. dm_ism_insert_record() stores idle duration records in the circular history buffer. These functions explain what they do, but they do not explain what their inputs mean. Fixes the below with gcc W=1: ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'current_state' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'event' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'next_state' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:153 function parameter 'ism' not described in 'dm_ism_get_idle_allow_delay' ../display/amdgpu_dm/amdgpu_dm_ism.c:153 function parameter 'stream' not described in 'dm_ism_get_idle_allow_delay' ../display/amdgpu_dm/amdgpu_dm_ism.c:216 function parameter 'ism' not described in 'dm_ism_insert_record' ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'current_state' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'event' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:44 function parameter 'next_state' not described in 'dm_ism_next_state' ../display/amdgpu_dm/amdgpu_dm_ism.c:153 function parameter 'ism' not described in 'dm_ism_get_idle_allow_delay' ../display/amdgpu_dm/amdgpu_dm_ism.c:153 function parameter 'stream' not described in 'dm_ism_get_idle_allow_delay' ../display/amdgpu_dm/amdgpu_dm_ism.c:216 function parameter 'ism' not described in 'dm_ism_insert_record' Fixes: 754003486c3c ("drm/amd/display: Add Idle state manager(ISM)") Cc: Ray Wu <ray.wu@amd.com> Cc: Leo Li <sunpeng.li@amd.com> Cc: Roman Li <roman.li@amd.com> Cc: Alex Hung <alex.hung@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Cc: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-03drm/amd/display: Fix parameter mismatch in panel self-refresh helperSrinivasan Shanmugam
Align parameter names with function arguments. The function controls panel self-refresh enable/disable based on vblank and VRR state. Fixes the below with gcc W=1: ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'dm' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'acrtc' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'stream' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'dm' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'acrtc' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' ../display/amdgpu_dm/amdgpu_dm_crtc.c:131 function parameter 'stream' not described in 'amdgpu_dm_crtc_set_panel_sr_feature' Fixes: 754003486c3c ("drm/amd/display: Add Idle state manager(ISM)") Cc: Ray Wu <ray.wu@amd.com> Cc: Leo Li <sunpeng.li@amd.com> Cc: Roman Li <roman.li@amd.com> Cc: Alex Hung <alex.hung@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Cc: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-03drm/amd/display: Use drm_display_info for AMD VSDB dataChenyu Chen
Replace the raw EDID byte-walking in parse_amd_vsdb() with a read from connector->display_info.amd_vsdb, now populated by drm_edid. Factor out panel type determination into dm_set_panel_type(), which checks VSDB panel_type, DPCD ext caps, and a luminance heuristic as fallbacks. Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-03drm/edid: Parse AMD Vendor-Specific Data BlockChenyu Chen
Parse the AMD VSDB v3 from CTA extension blocks and store the result in struct drm_amd_vsdb_info, a new field of drm_display_info. This includes replay mode, panel type, and luminance ranges. Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-03drm/amd/display: Fix dc_is_fp_enabled name mismatchSrinivasan Shanmugam
Fix incorrect function name in comment to match dc_is_fp_enabled. This function checks if FPU is currently active by reading a counter. The FPU helpers manage safe usage of FPU in the kernel by tracking when it starts and stops, avoiding misuse or crashes. Fixes: 3539437f354b ("drm/amd/display: Move FPU Guards From DML To DC - Part 1") Cc: Roman Li <roman.li@amd.com> Cc: Alex Hung <alex.hung@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Cc: Dillon Varone <dillon.varone@amd.com> Cc: Rafal Ostrowski <rafal.ostrowski@amd.com> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-03drm/amd/display: Wire up dcn10_dio_construct() for all pre-DCN401 generationsIonut Nechita
Description: - Commit b82f0759346617b2 ("drm/amd/display: Migrate DIO registers access from hwseq to dio component") moved DIO_MEM_PWR_CTRL register access behind the new dio abstraction layer but only created the dio object for DCN 4.01. On all other generations (DCN 10/20/21/201/30/301/302/303/ 31/314/315/316/32/321/35/351/36), the dio pointer is NULL, causing the register write to be silently skipped. This results in AFMT HDMI memory not being powered on during init_hw, which can cause HDMI audio failures and display issues on affected hardware including Renoir/Cezanne (DCN 2.1) APUs that use dcn10_init_hw. Call dcn10_dio_construct() in each older DCN generation's resource.c to create the dio object, following the same pattern as DCN 4.01. This ensures the dio pointer is non-NULL and the mem_pwr_ctrl callback works through the dio abstraction for all DCN generations. Fixes: b82f07593466 ("drm/amd/display: Migrate DIO registers access from hwseq to dio component.") Reviewed-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: Ionut Nechita <ionut_n2001@yahoo.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit a4983968fa5b3179ab090407d325a71cdc96874e)
2026-04-03drm/xe: expose multi-lrc engine classes in debugfs infoXin Wang
Expose multi_lrc_engine_classes in the info debugfs output as a useful extra piece of information for debugging. Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Signed-off-by: Xin Wang <x.wang@intel.com> Link: https://patch.msgid.link/20260402180552.24121-3-x.wang@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-04-03drm/xe: improve readability of debugfs engine info outputXin Wang
Improve the readability of the info debugfs output by replacing raw numeric engine masks with human-readable engine and class names. Also print per-GT engine capability data in a form that is easier for a human to interpret directly, and as a side effect simpler for IGT tests to use when validating engine capabilities. Reviewed-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Xin Wang <x.wang@intel.com> Link: https://patch.msgid.link/20260402180552.24121-2-x.wang@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-04-03drm/panthor: Add a GEM shrinkerAkash Goel
This implementation is losely based on the MSM shrinker, and it's relying on the drm_gpuvm eviction/validation infrastructure. Right now we only support swapout/eviction, but we could add an extra flag to specify when buffer content doesn't need to be preserved to avoid the swapout/swapin dance. Locking is a bit of a nightmare, but using _trylock() all the way in the reclaim path seems to make lockdep happy. And yes, we might be missing opportunities to reclaim when the system is under heavy GPU load/heavy memory pressure/heavy GPU VM activity, but that's better than no reclaim at all. v2: - Move gpu_mapped_shared next to the mmapped LRU - Add a bunch of missing is_[vm_bo,vma]_evicted() tests - Only test mmap_count to check if a BO is mmaped - Remove stale comment about shrinker not being a thing - Allow pin_count to be non-zero in panthor_gem_swapin_locked() - Fix panthor_gem_sync() to check for BO residency before doing the CPU sync - Fix the value returned by panthor_gem_shrinker_count() in case some memory has been released - Check drmm_mutex_init() ret code - Explicitly mention that PANTHOR_GEM_UNRECLAIMABLE is the initial state of all BOs v3: - Make panthor_gem_try_evict() static - Collect {A,R}-bs v4: - Update the reclaim_state in panthor_gem_mmap() - Don't reclaim GPU-mapped BOs if can_block() returns false - Skip evicited vm_bos in panthor_vm_update_bo_reclaim_lru_locked() to avoid spurious WARN_ON()s - Explain why we have to do this select_evicted_vma/repopulate_evicted_vma dance v5: - Properly report the reclaimable size in panthor_gem_debugfs_print_bos() - Check panthor_vm_lock_region() errors in panthor_vm_evict_bo_mappings_locked() - Fix lock order inversion (dma_resv_wait_timeout() inside gpuva.lock) v6: - Don't remap if the unmapped VMA is evicted. - Drop a stale comment in panthor_gem_dev_map_get_sgt_locked() - s/PANTHOR_GEM_GPU_MAPPED_PRIVATE/PANTHOR_GEM_GPU_MAPPED_SINGLE_VM/ - s/PANTHOR_GEM_GPU_MAPPED_SHARED/PANTHOR_GEM_GPU_MAPPED_MULTI_VM/ - Just count the number of vm_bo to determine the reclaim state in is_gpu_mapped() - Drop a redundant panthor_gem_backing_get_pages_locked() call in panthor_gem_swapin_locked() - Add more comments to panthor_vm_evict_bo_mappings_locked() to convince Claude it's actually safe. - Add a comment in panthor_gem_shrinker_count() to mention the race and hopefully clear Claude's concerns. - Rework the "is-still-in-list" check we have in panthor_mmu_reclaim_priv_bos() to address Claude's concerns - Don't call panthor_vm_unlock_region() if panthor_vm_lock_region() fails in remap_evicted_vma(). Was harmless, but confusing, as pointed out by Claude - Fix can_block() to allow blocking on KSWAPD_RECLAIM-only in a kswapd context - Fix a lockdep warning when the last ref on a BO is released in the shrinker path, where the resv lock can't be acquired other than with a try_lock() v7: - Skip drm_gpuvm_bo_deferred_cleanup() when repopulating VMAs to fix a deadlock Signed-off-by: Akash Goel <akash.goel@arm.com> Acked-by: Liviu Dudau <liviu.dudau@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20260401134854.2275433-11-boris.brezillon@collabora.com Co-developed-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-03drm/panthor: Track the number of mmap on a BOBoris Brezillon
This will be used to order things by reclaimability. v2: - Fix refcounting v3: - Fix refcounting (again) v4: - Collect R-b v5: - Collect R-b v6: - Warn on is_imported() (not supposed to happen since mmap is redirected to the dmabuf layer) instead of adding a conditional in panthor_gem_vm_open() v7: - No changes Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260401134854.2275433-10-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-03drm/panthor: Split panthor_vm_prepare_map_op_ctx() to prepare for reclaimBoris Brezillon
We're gonna need just the page table reservation logic when we restore evicted BO mappings, so let's prepare for that by extracting the op_ctx init and page table pre-allocation into separate helpers. v2: - Collect R-bs v3: - No changes v4: - No changes v5: - No changes v6: - No changes v7: - No changes Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20260401134854.2275433-9-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-03drm/panthor: Lazily allocate pages on mmap()Boris Brezillon
Defer pages allocation until their first access. v2: - Don't deal with FAULT_FLAG_INTERRUPTIBLE - Make sure bo->backing.pages is never an ERR_PTR() - Drop a useless vm_fault_t local var - Fix comment in panthor_gem_fault() v3: - Collect R-bs v4: - No changes v5: - No changes v6: - Fix huge_fault handling v7: - No changes Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260401134854.2275433-8-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-03drm/panthor: Part ways with drm_gem_shmem_objectBoris Brezillon
While drm_gem_shmem_object does most of the job we need it to do, the way sub-resources (pages, sgt, vmap) are handled and their lifetimes gets in the way of BO reclaim. There has been attempts to address that [1], but in the meantime, new gem_shmem users were introduced (accel drivers), and some of them manually free some of these resources. This makes things harder to control/sanitize/validate. Thomas Zimmerman is not a huge fan of enforcing lifetimes of sub-resources and forcing gem_shmem users to go through new gem_shmem helpers when they need manual control of some sort, and I believe this is a dead end if we don't force users to follow some stricter rules through carefully designed helpers, because there will always be one user doing crazy things with gem_shmem_object internals, which ends up tripping out the common helpers when they are called. The consensus we reached was that we would be better off forking gem_shmem in panthor. So here we are, parting ways with gem_shmem. The current transition tries to minimize the changes, but there are still some aspects that are different, the main one being that we no longer have a pages_use_count, and pages stays around until the GEM object is destroyed (or when evicted once we've added a shrinker). The sgt also no longer retains pages. This is losely based on how msm does things by the way. If there's any interest in sharing code (probably with msm, since the panthor shrinker is going to be losely based on the msm implementation), we can always change gears and do that once we have everything working/merged. [1]https://patchwork.kernel.org/project/dri-devel/patch/20240105184624.508603-1-dmitry.osipenko@collabora.com/ v2: - Fix refcounting - Add a _locked suffix to a bunch of functions expecting the resv lock to be held - Take the lock before releasing resources in panthor_gem_free_object() v3: - Use ERR_CAST() to fix an ERR-ptr deref - Add missing resv_[un]lock() around a panthor_gem_backing_unpin_locked() call v4: - Fix an error path in panthor_gem_vmap_get_locked() - Don't leave bo->base.pages with an ERR_PTR() - Make panthor_gem_{pin,unpin}[_locked]() more consistent - Don't fail in panthor_gem_dev_map_get_sgt_locked() if the pages are not allocated v5: - Add missing static specifier on our vm_ops v6: - Fix huge_fault handling - s/uint32_t/u32/ - s/drm_dbg_kms/drm_dbg_driver/ - Collect R-bs v7: - No changes Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260401134854.2275433-7-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-03drm/panthor: Don't call drm_gpuvm_bo_extobj_add() if the object is privateBoris Brezillon
drm_gpuvm_bo_extobj_add() is a NOP if the object is private, but it forces us to take/release the VM resv lock, so let's do that only when we know the object can be shared. v3: - New commit v4: - Collect R-bs v5: - No changes v6: - No changes v7: - No changes Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260401134854.2275433-6-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-03drm/panthor: Group panthor_kernel_bo_xxx() helpersBoris Brezillon
Move all panthor_kernel_bo_xxx() helpers at the end of the file, just before the debugfs init logic. This will make further panthor_gem.c refactoring more readable. v2: - Collect R-bs v3: - No changes v4: - No changes v5: - No changes v6: - No changes v7: - No changes Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20260401134854.2275433-5-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-03drm/panthor: Move panthor_gems_debugfs_init() to panthor_gem.cBoris Brezillon
There's no reason for panthor_drv to know about panthor_gem.c internals, so let's move the GEM debugfs init logic to panthor_gem.c. v2: - Collect R-bs v3: -No changes v4: - No changes v5: - No changes v6: - No changes v7: - No changes Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20260401134854.2275433-4-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-03drm/panthor: Remove unused panthor_vm_op_ctx::map::new_vma fieldBoris Brezillon
This field is never used, drop it. v7: - New patch Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260401134854.2275433-3-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-03drm/gem: Consider GEM object reclaimable if shrinking failsBoris Brezillon
If the object wasn't moved to a different LRU after the shrink callback returns, it means the buffer is still reclaimable. Update the remaining counter to reflect that. v2: - Collect R-b v3: - Collect R-b v4: - No changes v5: - No changes v6: - No changes v7: - No changes Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20260401134854.2275433-2-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-03tyr: remove impl Send/Sync for TyrDataAlice Ryhl
Now that clk implements Send and Sync, we no longer need to manually implement these traits for TyrData. Thus remove the implementations. The comment also mentions the regulator. However, the regulator had the traits added in commit 9a200cbdb543 ("rust: regulator: implement Send and Sync for Regulator<T>"), which is already in mainline. Reviewed-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Boqun Feng <boqun.feng@gmail.com> Reviewed-by: Gary Guo <gary@garyguo.net> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20260223-clk-send-sync-v5-2-181bf2f35652@google.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-04-03Merge tag 'drm-misc-fixes-2026-04-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A refcounting fix for bridges, revert a previous framebuffer use-after-free fix that turned out to be causing more problems, a hang fix for qaic, an initialization fix for ast, a error handling fix for sysfb, and a speculation fix for drm_compat_ioctl. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@redhat.com> Link: https://patch.msgid.link/20260402-vivid-perfect-caiman-ca055e@houat
2026-04-03Merge tag 'drm-msm-next-2026-04-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/msm into drm-next Changes for v7.1 CI: - Uprev mesa - Restore CI jobs for Qualcomm APQ8016 and APQ8096 devices Core: - Switched to of_get_available_child_by_name() DPU: - Fixes for DSC panels - Fixed brownout because of the frequency / OPP mismatch - Quad pipe preparation (not enabled yet) - Switched to virtual planes by default - Dropped VBIF_NRT support - Added support for Eliza platform - Reworked alpha handling - Switched to correct CWB definitions on Eliza - Dropped dummy INTF_0 on MSM8953 - Corrected INTFs related to DP-MST DP: - Removed debug prints looking into PHY internals DSI: - Fixes for DSC panels - RGB101010 support - Support for SC8280XP - Moved PHY bindings from display/ to phy/ GPU: - Preemption support for x2-85 and a840 - IFPC support for a840 - SKU detection support for x2-85 and a840 - Expose AQE support (VK ray-pipeline) - Avoid locking in VM_BIND fence signaling path - Fix to avoid reclaim in GPU snapshot path - Disallow foreign mapping of _NO_SHARE BOs - Couple a6xx gpu snapshot fixes - Various other fixes HDMI: - Fixed infoframes programming MDP5: - Dropped support for MSM8974v1 - Dropped now unused code for MSM8974 v1 and SDM660 / MSM8998 Also misc small fixes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rob Clark <rob.clark@oss.qualcomm.com> Link: https://patch.msgid.link/CACSVV012vn73BaUfk=Hw4WkQHZNPHiqfifWEunAqMc2EGOWUEQ@mail.gmail.com
2026-04-03Merge tag 'amd-drm-fixes-7.0-2026-04-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.0-2026-04-02: amdgpu: - Fix audio regression on renoir Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260402194409.914769-1-alexander.deucher@amd.com
2026-04-03Merge tag 'drm-xe-fixes-2026-04-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes uAPI Fix: - Accept canonical GPU addresses in xe_vm_madvise_ioctl (Arvind) Driver Fixes: - Disallow writes to read-only VMAs (Jonathan) - PXP fixes (Daniele) - Disable garbage collector work item on SVM clos (Brost) - void memory allocations in xe_device_declare_wedged (Brost) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/ac5mDHs-McR5cJSV@intel.com
2026-04-03Merge tag 'drm-intel-fixes-2026-04-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix for #12045: Huawei Matebook E (DRR-WXX): Persistent Black Screen on Boot with i915 and Gen11: Modesetting and Backlight Control Malfunction - Fix for #15826: i915: Raptor Lake-P [UHD Graphics] display flicker/corruption on eDP panel - Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP Signed-off-by: Dave Airlie <airlied@redhat.com> From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patch.msgid.link/ac5DM1IpBkuaT58e@jlahtine-mobl
2026-04-03drm/shmem_helper: Make sure PMD entries get the writeable upgradeBoris Brezillon
Unlike PTEs which are automatically upgraded to writeable entries if .pfn_mkwrite() returns 0, the PMD upgrades go through .huge_fault(), and we currently pretend to have handled the make-writeable request even though we only ever map things read-only. Make sure we pass the proper "write" info to vmf_insert_pfn_pmd() in that case. This also means we have to record the mkwrite event in the .huge_fault() path now. Move the dirty tracking logic to a drm_gem_shmem_record_mkwrite() helper so it can also be called from drm_gem_shmem_pfn_mkwrite(). Note that this wasn't a problem before commit 28e3918179aa ("drm/gem-shmem: Track folio accessed/dirty status in mmap"), because the pgprot were not lowered to read-only before this commit (see the vma_wants_writenotify() in vma_set_page_prot()). Fixes: 28e3918179aa ("drm/gem-shmem: Track folio accessed/dirty status in mmap") Cc: Biju Das <biju.das.jz@bp.renesas.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com> Reviewed-by: Loïc Molinari <loic.molinari@collabora.com> Tested-by: Biju Das <biju.das.jz@bp.renesas.com> Acked-by: Thomas Zimmermann <tzimmermann@suse.de> Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com> Link: https://patch.msgid.link/20260320151914.586945-1-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-04-02drm/amd/display: Wire up dcn10_dio_construct() for all pre-DCN401 generationsIonut Nechita
Description: - Commit b82f0759346617b2 ("drm/amd/display: Migrate DIO registers access from hwseq to dio component") moved DIO_MEM_PWR_CTRL register access behind the new dio abstraction layer but only created the dio object for DCN 4.01. On all other generations (DCN 10/20/21/201/30/301/302/303/ 31/314/315/316/32/321/35/351/36), the dio pointer is NULL, causing the register write to be silently skipped. This results in AFMT HDMI memory not being powered on during init_hw, which can cause HDMI audio failures and display issues on affected hardware including Renoir/Cezanne (DCN 2.1) APUs that use dcn10_init_hw. Call dcn10_dio_construct() in each older DCN generation's resource.c to create the dio object, following the same pattern as DCN 4.01. This ensures the dio pointer is non-NULL and the mem_pwr_ctrl callback works through the dio abstraction for all DCN generations. Fixes: b82f07593466 ("drm/amd/display: Migrate DIO registers access from hwseq to dio component.") Reviewed-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: Ionut Nechita <ionut_n2001@yahoo.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-04-02drm/vc4: Clean-up UAPI header inclusionMaíra Canal
"uapi/drm/vc4_drm.h" is already included through "vc4_drv.h". Therefore, remove its direct inclusion from several files. Suggested-by: Melissa Wen <mwen@igalia.com> Reviewed-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-6-92defc940a29@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-04-02drm/vc4: Use devm_request_irq() for automatic cleanupMaíra Canal
Switch from request_irq()/free_irq() to the device-managed alternative devm_request_irq(), letting device-managed resource cleanup handle IRQ teardown automatically. While here, inline vc4_irq_prepare() into vc4_irq_install() since it's the only caller. Reviewed-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-5-92defc940a29@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-04-02drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lockMaíra Canal
The mmap callback reads bo->madv without holding madv_lock, racing with concurrent DRM_IOCTL_VC4_GEM_MADVISE calls that modify the field under the same lock. Add the missing locking to prevent the data race. Fixes: b9f19259b84d ("drm/vc4: Add the DRM_IOCTL_VC4_GEM_MADVISE ioctl") Reviewed-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-4-92defc940a29@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-04-02drm/vc4: Fix a memory leak in hang state error pathMaíra Canal
When vc4_save_hang_state() encounters an early return condition, it returns without freeing the previously allocated `kernel_state`, leaking memory. Add the missing kfree() calls by consolidating the early return paths into a single place. Fixes: 214613656b51 ("drm/vc4: Add an interface for capturing the GPU state after a hang.") Reviewed-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-3-92defc940a29@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-04-02drm/vc4: Fix memory leak of BO array in hang stateMaíra Canal
The hang state's BO array is allocated separately with kzalloc() in vc4_save_hang_state() but never freed in vc4_free_hang_state(). Add the missing kfree() for the BO array before freeing the hang state struct. Fixes: 214613656b51 ("drm/vc4: Add an interface for capturing the GPU state after a hang.") Reviewed-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-2-92defc940a29@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-04-02drm/vc4: Release runtime PM reference after binding V3DMaíra Canal
The vc4_v3d_bind() function acquires a runtime PM reference via pm_runtime_resume_and_get() to access V3D registers during setup. However, this reference is never released after a successful bind. This prevents the device from ever runtime suspending, since the reference count never reaches zero. Release the runtime PM reference by adding pm_runtime_put_autosuspend() after autosuspend is configured, allowing the device to runtime suspend after the delay. Fixes: 266cff37d7fc ("drm/vc4: v3d: Rework the runtime_pm setup") Reviewed-by: Melissa Wen <mwen@igalia.com> Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-1-92defc940a29@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-04-02drm/xe: Drop redundant rtp entries for Wa_14019988906 & Wa_14019877138Matt Roper
There appears to have been a silent merge conflict between some commits updating the workaround tables on Xe's -fixes and -next branches: - Commit bc6387a2e0c1 ("drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138") from the fixes branch moved the Xe2_HPG instance of two workarounds touching the PSS_CHICKEN register from the engine_was[] table to the lrc_was[] table; the equivalent implementation for all other platforms/IPs were already properly located on lrc_was[]. This commit on the fixes branch is a cherry-pick of commit e04c609eedf4 ("drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138") that already existed on the next branch. - Commit 55b19abb6c44 ("drm/xe: Consolidate workaround entries for Wa_14019877138") and commit c2142a1a8415 ("drm/xe: Consolidate workaround entries for Wa_14019988906") consolidated the individual entries per IP generation for each workaround into single, larger range-based entries. During merge conflict resolution the Xe2_HPG-specific entries (i.e., those with rule "GRAPHICS_VERSION_RANGE(2001, 2002)") were accidentally resurrected, even though the table already contains the consolidated entries that match a superset of thse ranges. These redundant entries don't cause any build failures but do trigger a dmesg error during probe on BMG-G21 devices: xe 0000:03:00.0: [drm] *ERROR* Tile0: GT0: discarding save-restore reg 7044 (clear: 00000400, set: 00000400, masked: yes, mcr: yes): ret=-22 xe 0000:03:00.0: [drm] *ERROR* Tile0: GT0: discarding save-restore reg 7044 (clear: 00000020, set: 00000020, masked: yes, mcr: yes): ret=-22 Re-drop the Xe2_HPG-specific table entries to eliminate the error. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7433 Fixes: 17b95278ae6a ("Merge tag 'drm-xe-next-2026-03-02' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next") Cc: Dave Airlie <airlied@redhat.com> Signed-off-by: Matt Roper <matthew.d.roper@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Link: https://patch.msgid.link/20260401-wa_merge_conflict-v1-1-b477ab53fedc@intel.com Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-04-02drm/xe: pass struct xe_device to xe_display_bo_fbdev_prefer_stolen()Jani Nikula
This is xe core code, use struct xe_device for simplicity. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/56bd532dc5cf460cdbf17c7781f18db5378a28e6.1774950508.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-04-02drm/i915: pass struct drm_i915_private to i915_bo_fbdev_prefer_stolen()Jani Nikula
This is i915 core code, use struct drm_i915_private for simplicity. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/321edddfd7509fd2cff0303747cdf18bb0cb911d.1774950508.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-04-02drm/{i915, xe}: move fbdev fb calls to parent interfaceJani Nikula
Move the driver specific fbdev fb calls to the display parent interface. Reuse the existing struct intel_display_bo_interface, as this is mostly about gem objects. Put everything behind IS_ENABLED(CONFIG_DRM_FBDEV_EMULATION) to catch configuration issues at build or link time. v2: Rebase Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> # v1 Link: https://patch.msgid.link/a6bb24909a58181cfc41b91a4c6538a181d27158.1774950508.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-04-02drm/{i915, xe}/fbdev: drop drm device parameter from intel_fbdev_fb_fill_info()Jani Nikula
The struct drm_device *drm parameter of intel_fbdev_fb_fill_info() is redundant, as you can obtain the same information via obj->dev. Drop the drm parameter, and move obj as first (or the context) parameter. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/6c617dc41c07b0e3e9af01b82d0d1dadbd4760fc.1774950508.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-04-02drm/xe/fbdev: put intel_fbdev_fb_prefer_stolen() behind ↵Jani Nikula
IS_ENABLED(CONFIG_DRM_FBDEV_EMULATION) Unify the behaviour with i915. Similar to commit b63c6b9b7f5e ("drm/i915/fbdev: fix link failure without FBDEV emulation"). The difference is that unlike i915, xe doesn't build display/intel_fbdev_fb.c conditional to CONFIG_DRM_FBDEV_EMULATION. Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Link: https://patch.msgid.link/245880a591fe5267a1c06bfbbcc42a4dd9f2e4ee.1774950508.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-04-02drm/ioc32: stop speculation on the drm_compat_ioctl pathGreg Kroah-Hartman
The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list. Fixes: 505b5240329b ("drm/ioctl: Fix Spectre v1 vulnerabilities") Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: David Airlie <airlied@gmail.com> Cc: Simona Vetter <simona@ffwll.ch> Cc: stable <stable@kernel.org> Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Simona Vetter <simona@ffwll.ch> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/2026032451-playing-rummage-8fa2@gregkh
2026-04-02drm/i915/psr: Do not use pipe_src as borders for SU areaJouni Högander
This far using crtc_state->pipe_src as borders for Selective Update area haven't caused visible problems as drm_rect_width(crtc_state->pipe_src) == crtc_state->hw.adjusted_mode.crtc_hdisplay and drm_rect_height(crtc_state->pipe_src) == crtc_state->hw.adjusted_mode.crtc_vdisplay when pipe scaling is not used. On the other hand using pipe scaling is forcing full frame updates and all the Selective Update area calculations are skipped. Now this improper usage of crtc_state->pipe_src is causing following warnings: <4> [7771.978166] xe 0000:00:02.0: [drm] drm_WARN_ON_ONCE(su_lines % vdsc_cfg->slice_height) after WARN_ON_ONCE was added by commit: "drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters" These warnings are seen when DSC and pipe scaling are enabled simultaneously. This is because on full frame update SU area is improperly set as pipe_src which is not aligned with DSC slice height. Fix these by creating local rectangle using crtc_state->hw.adjusted_mode.crtc_hdisplay and crtc_state->hw.adjusted_mode.crtc_vdisplay. Use this local rectangle as borders for SU area. Fixes: d6774b8c3c58 ("drm/i915: Ensure damage clip area is within pipe area") Cc: <stable@vger.kernel.org> # v6.0+ Signed-off-by: Jouni Högander <jouni.hogander@intel.com> Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://patch.msgid.link/20260327114553.195285-1-jouni.hogander@intel.com
2026-04-01drm/gpusvm: Reject VMAs with VM_IO or VM_PFNMAP when creating SVM rangesMatthew Brost
VMAs marked with VM_IO or VM_PFNMAP are not backed by struct page objects, which GPUSVM requires in order to operate correctly. In particular, get_pages() relies on hmm_range_fault() to resolve struct pages for the target range. Attempting to create an SVM range on such VMAs results in repeated get_pages() failures and can lead to an infinite loop inside a driver’s page‑fault handler. Prevent this by rejecting ranges on VM_IO or VM_PFNMAP VMAs and returning -EIO. Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory") Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260325231608.25581-1-matthew.brost@intel.com
2026-04-02Merge tag 'amd-drm-next-7.1-2026-04-01' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-7.1-2026-04-01: amdgpu: - UserQ fixes - PASID handling fix - S4 fix for smu11 chips - devcoredump fixes - RAS fixes - Misc small fixes - DCN 4.2 updates - DVI fixes - DML fixes - DC pipe validation fixes - eDP DSC seamless boot - DC FP rework - swsmu cleanups - GC 11.5.4 updates - Add DC idle state manager - Add support for using multiple engines for buffer fills and clears - Misc SMU7 fixes amdkfd: - Non-4K page fixes - Logging cleanups - sysfs fixes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260401184456.3576660-1-alexander.deucher@amd.com
2026-04-01drm/xe/vm: Add missing pad and extensions checkJonathan Cavitt
Add missing pad and extensions check to xe_vm_get_property_ioctl v2: - Combine with other check (Auld) Fixes: 50c577eab051 ("drm/xe/xe_vm: Implement xe_vm_get_property_ioctl") Suggested-by: Matthew Auld <matthew.auld@intel.com> Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260331181216.37775-2-jonathan.cavitt@intel.com
2026-04-01drm/msm: Use of_get_available_child_by_name()Biju Das
Simplify zap_shader_load_mdt() by using of_get_available_child_by_name(). Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Patchwork: https://patchwork.freedesktop.org/patch/635020/ Link: https://lore.kernel.org/r/20250201155830.39366-1-biju.das.jz@bp.renesas.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
2026-04-01drm/msm/dpu: eliza: Use Eliza-specific CWB arrayKrzysztof Kozlowski
The driver references CWB array from SM8650, but should use the Eliza specific, which has different register space sizes. This should not have noticeable impact on function but is indeed confusing, since the Eliza table is used for .cwb_count. Fixes: 0eb707bbc7fc ("drm/msm/dpu: Add support for Eliza SoC") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/715623/ Link: https://lore.kernel.org/r/20260331161156.211623-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-06 10:52:52 +0000