summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-07-08drm/amdkfd: Don't acquire buffers during CRIU queue restore.David Francis
kfd_criu_restore_queue's call of kfd_queue_acquire_buffers was failing for multiple reasons - The ctl_stack_size set by the CRIU plugin doesn't match what is expected by acquire_buffers - The svm buffer cannot be acquired at this point because CRIU may not have restored it, or may have restored it to a different address. The only reason acquire_buffers was necessary here was to avoid a null ptr dereference in init_user_queue. Just put in a check for that dereference; it doesn't appear to come up in real use cases right now. That is, there is no usage of CRIU with shared MES. This is a partial revert of commit 20a5e7ffdfec ("drm/amdkfd: Properly acquire queue buffers in CRIU restore") Fixes: 20a5e7ffdfec ("drm/amdkfd: Properly acquire queue buffers in CRIU restore") Reviewed-by: David Yat Sin <david.yatsin@amd.com> Signed-off-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: Check bounds on CRIU restore queue type and mqd sizeDavid Francis
We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided type is less than it. For mqd_size, add new function mqd_size_from_queue_type and confirm that the provided mqd_size matches expectations. Reviewed-by: David Yat Sin <david.yatsin@amd.com> Signed-off-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()Shahyan Soltani
The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_irqrestore is called and returned, the pointer is no longer under lock and is subject to modification. Since, the caller still dereferences vm->task_info in amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a use after unlock problem. Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() through removing the amdgpu_vm_get_vm_from_pasid() function from amdgpu_vm.c and making the relevant code inline to hold the lock while it is still in use. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: include amdgpu_video_codecs.h only where neededShahyan Soltani
Remove #include "amdgpu_video_codecs.h" from amdgpu.h and add forward declaration of struct amdgpu_video_codecs. Add #include "amdgpu_video_codecs.h" into files amdgpu_kms.c, amdgpu_virt.c, cik.c, nv.c, si.c, soc15.c, soc21.c, soc24.c, soc_v1_0.c, and vi.c. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move amdgpu_allowed_register_entry into amdgpu_reg_access.hShahyan Soltani
Move struct amdgpu_allowed_register_entry from monolithic amdgpu.h file into existing amdgpu_reg_access.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move amdgpu_acpi helpers into new headerShahyan Soltani
Move struct amdgpu_uma_carveout_option, struct amdgpu_uma_carveout_info, struct amdgpu_numa_info, and relevant acpi helpers from the monolithic amdgpu.h header file into a new amdgpu_acpi.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amd/display: Fix sign mismatch warningGeorge Zhang
Using mismatched signedness (int and uint32_t) causes a -Wsign-compare warning. Fix it by changing the min macro to min_t to explicitly cast. Fixes: 8cbe3648aa86 ("drm/amd/display: clamp DMUB AUX reply length to payload buffer") Signed-off-by: George Zhang <george.zhang@amd.com> Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move struct amdgpu_mqd and helpers into header fileShahyan Soltani
Move struct amdgpu_mqd_prop, struct amdgpu_mqd, and helpers from the monolithic amdgpu.h into existing amdgpu_mes.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move struct amdgpu_video_codecs and helpers into header fileShahyan Soltani
Move struct amdgpu_video_codec_info, struct amdgpu_video_codecs, and helpers into a new amdgpu_video_codecs.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move struct amdgpu_wb and helpers into separate filesShahyan Soltani
Move struct amdgpu_wb and helpers out of the monolithic header amdgpu.h into its own dedicated header amdgpu_wb.h. Add amdgpu_wb_init() and amdgpu_wb_fini() into amdgpu_wb.h. Move functions amdgpu_device_wb_get(), amdgpu_device_wb_free(), amdgpu_device_wb_init(), and amdgpu_device_wb_fini() out of amdgpu_device.c into new dedicated amdgpu_wb.c file. Removed static from functions amdgpu_device_wb_init() and amdgpu_device_wb_fini(). Rename functions amdgpu_device_wb_get(), amdgpu_device_wb_free(), amdgpu_device_wb_init(), and amdgpu_device_wb_fini() into amdgpu_wb_get(), amdgpu_wb_free(), amdgpu_wb_init(), and amdgpu_wb_fini(). Update amdgpu/Makefile to build amdgpu_wb.o. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/mes12: Remove MES self testSrinivasan Shanmugam
The MES self test is no longer needed. Other MES versions already dropped their self tests since IGT now covers this functionality. Remove the MES v12 self test as well. Cc: Alex Deucher <alexander.deucher@amd.com> Suggested-by: Christian König <christian.koenig@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queueJesse Zhang
Destroying a hung user queue issues a MES REMOVE_QUEUE that times out, The destroy path only logged the error and freed the queue, so the next userq submission failed and forced a GPU reset attributed to an innocent workload. Kick the userq reset work when unmap fails so the GPU is recovered at destroy time. Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabledKenneth Feng
Disable ASPM on VI if PCIE dpm is disabled. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5370 Signed-off-by: Kenneth Feng <kenneth.feng@amd.com> Reviewed-by: Yang Wang <kevinyang.wang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy deferred error separate loggingCe Sun
Remove the legacy logic that logs deferred errors separately Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy get_retire_flip_bits interface for UMCCe Sun
Remove the legacy general get_retire_flip_bits interface for UMC Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy get_retire_flip_bits for UMCCe Sun
Remove the legacy get_retire_flip_bits implementation for UMC v12 Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy mca umc status check interfaceCe Sun
Remove the legacy interface to check mca umc status Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amd/pm: retire legacy ras_smu_drv interface for smu v13.0.12Ce Sun
Remove the legacy ras_smu_drv interface implementation for SMU v13.0.12 Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCCGeoffrey McRae
The loop iterated only AMDGPU_MAX_MES_PIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed by XCC ID >= 2. Extend the loop to cover all XCCs (AMDGPU_MAX_MES_PIPES * num_xcc), matching other per-XCC arrays. Fixes: a132fc9bc2f8 ("drm/amdgpu: Fixup boost mes detect hang array size") Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com> Reviewed-by: Amber Lin <amber.lin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: use iosys_map for CWSR buffer accessJames Zhu
After moving TBA/TMA from GTT to VRAM for GFX9.4.2+ in commit 5088a1ba6d6d ("drm/amdkfd: move TBA/TMA from system to device memory"), direct pointer dereferences to CWSR buffers became unsafe because VRAM is accessed via MMIO (PCI BAR mappings). Direct writes like 'tma[2] = enabled' and memcpy() can fail or produce incorrect results on non-x86 architectures because: - MMIO requires specific accessor functions (writeq/readq) - Compiler optimizations may generate invalid instruction sequences - No guarantee of proper memory barriers or atomic access This patch converts CWSR buffer access to use struct iosys_map, which automatically handles both system memory (GTT) and MMIO (VRAM) correctly by: - Using writeq/writel/memcpy_toio for MMIO regions - Using WRITE_ONCE/memcpy for system memory - Providing proper memory barriers and access guarantees Changes: - Replace void *cwsr_kaddr with struct iosys_map cwsr_map - Detect MMIO vs system memory using TTM_BO_MAP_IOMEM_MASK - Use iosys_map_wr() for writing trap handler addresses and flags - Use iosys_map_memcpy_to() for copying CWSR ISA code This ensures correct operation on all architectures while maintaining backward compatibility with older GPUs and APUs that use GTT. Assisted-by: Claude:Claude-Opus-4.6 Signed-off-by: James Zhu <James.Zhu@amd.com> Acked-by: Christian König <christian.koenig@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/mes: Add NULL check for mes_hung_db_array allocationGeoffrey McRae
kcalloc but does not check for failure. If the allocation fails, the pointer remains NULL but the function returns success. Subsequent code using this buffer will dereference a NULL pointer, causing a kernel oops. Add a check to return -ENOMEM if the allocation fails. Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/jpeg: deduplicate jpeg_v5_3_0 process_interruptTiago Dourado
The jpeg_v5_3_0_process_interrupt function is identical to jpeg_v5_0_0_process_interrupt. Remove the duplicate implementation in jpeg_v5_3_0 and assign the jpeg_v5_0_0 version directly to the irq_funcs struct. Export jpeg_v5_0_0_process_interrupt through jpeg_v5_0_0.h to allow cross-version reuse. Signed-off-by: Tiago Dourado <tiagodourado@usp.br> Co-developed-by: Luiz Fernandes <luiz.f.f.fernandes@usp.br> Signed-off-by: Luiz Fernandes <luiz.f.f.fernandes@usp.br> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/jpeg: deduplicate jpeg_v3_0 process_interruptTiago Dourado
The jpeg_v3_0_process_interrupt function is identical to jpeg_v2_0_process_interrupt. Remove the duplicate implementation in jpeg_v3_0 and assign the jpeg_v2_0 version directly to the irq_funcs struct. Export jpeg_v2_0_process_interrupt through jpeg_v2_0.h to allow cross-version reuse. Signed-off-by: Tiago Dourado <tiagodourado@usp.br> Co-developed-by: Luiz Fernandes <luiz.f.f.fernandes@usp.br> Signed-off-by: Luiz Fernandes <luiz.f.f.fernandes@usp.br> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amd/pm: retire legacy smu ras driver frameworkCe Sun
Remove the legacy smu ras driver framework Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy pmfw eeprom support checkCe Sun
Remove the legacy function to check pmfw eeprom support Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: Disable JDPG on VCN5_3Suresh Guttula
JDPG does not support on VCN5 This patch will disable JDPG, because DPG is not correctly copying the JRBC Read/Write Pointers (R/WPTR) from the PG (Power Gating) block to JRBC. Signed-off-by: Suresh Guttula <suresh.guttula@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: add support for SMU version 15.0.9Kanala Ramalingeswara Reddy
Initialize SMU Version 15_0_9 Signed-off-by: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com> Signed-off-by: Granthali Vinodkumar Dhandar <granthali.vinodkumardhandar@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: add support for PSP version 15.0.9Kanala Ramalingeswara Reddy
Initialize PSP Version 15_0_9 Signed-off-by: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com> Signed-off-by: Granthali Vinodkumar Dhandar <granthali.vinodkumardhandar@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy pmfw eeprom interface wrapperCe Sun
retire legacy pmfw eeprom interface wrapper functions Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: drop duplicate kfd_queue_acquire_buffers()Alex Deucher
Duplicated code from the merge. Drop it. Fixes: 0461ba9a7994 ("Merge tag 'amd-drm-next-7.3-2026-07-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-next") Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08gpu: nova-core: build SetRegistry entries dynamicallyZhi Wang
The GSP SetRegistry command currently stores its registry entries in a fixed-size array. That makes every additional runtime-dependent registry object require reshaping the command data structure at the same time as the feature that needs the new entry. Keep the existing registry contents unchanged, but store them in a KVec so SetRegistry can be constructed dynamically. The constructor now returns a Result to propagate allocation failures while the command payload layout is still computed from the final entry list. Cc: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Zhi Wang <zhiw@nvidia.com> Link: https://patch.msgid.link/20260701062622.3499033-7-zhiw@nvidia.com [acourbot: remove orphan comment.] Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-08gpu: nova-core: fsp: rename FSP response header typeZhi Wang
FSP message handling currently uses FspResponse for the common response prefix containing the MCTP header, NVDM header and command response payload. That name is too broad once other FSP response formats reuse the same prefix and append protocol-specific payloads. Rename it to FspResponseHeader so subsequent response structures can embed the common header without overloading the meaning of FspResponse. Suggested-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://lore.kernel.org/all/DJMBI9CN2Z67.2T02SR8TAWEC5@nvidia.com/ Signed-off-by: Zhi Wang <zhiw@nvidia.com> Link: https://patch.msgid.link/20260701062622.3499033-4-zhiw@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-08drm/v3d: bound CPU-job query writes to their destination BOMichael Bommarito
The V3D_SUBMIT_CPU CPU jobs take user-supplied offsets and indices and consume them at exec time without checking that the accesses stay inside their BO: - TIMESTAMP_QUERY and RESET_TIMESTAMP_QUERY write one u64 per query into bo[0] at a fully user-controlled per-query offset. - COPY_TIMESTAMP_QUERY copies one u64 per query into bo[0] at offset + i * stride, and reads each result from a user-controlled offset in the source bo[1]. - COPY_PERFORMANCE_QUERY writes nperfmons * DRM_V3D_MAX_PERF_COUNTERS counter slots plus an availability slot into bo[0] at the same geometry. - INDIRECT_CSD reads three u32 work-group counts from bo[0] at a user-controlled offset, then writes each count back into the indirect BO at a user-controlled u32 index (wg_uniform_offsets[]). A render-node user (DRM_RENDER_ALLOW, no master, no capability) can make the handlers read or write past a BO's vmap mapping. Validate the full access extent against the BO size once the BOs are looked up, before the job is queued, rejecting out-of-range geometry with -EINVAL. The copy extent offset + (count - 1) * stride + write_size is computed in u64, mirroring the u8 * pointer arithmetic in the executors: (count - 1) * stride is a u32 * u32 product that is exact in u64, so one overflow check on the total guards the bound. The performance slot count and the bare timestamp, copy-source and indirect offsets are computed in u64 the same way, so a user value cannot wrap the comparison. Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Fixes: 9ba0ff3e083f ("drm/v3d: Create a CPU job extension for the timestamp query job") Fixes: 34a101e64296 ("drm/v3d: Create a CPU job extension for the reset timestamp job") Fixes: 6745f3e44a20 ("drm/v3d: Create a CPU job extension to copy timestamp query to a buffer") Fixes: 209e8d2695ee ("drm/v3d: Create a CPU job extension for the copy performance query job") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Reviewed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com> Link: https://patch.msgid.link/20260707221334.3854433-1-michael.bommarito@gmail.com
2026-07-08drm/panel: Use drm_of_get_panel_orientation()Thierry Reding
The old of_drm_get_panel_orientation() function was replaced by the drm_of_get_panel_orientation() in the core DRM OF helpers. Replace all uses of the old helper and remove it. Changes in v5: - also convert r63419 panel Changes in v4: - also convert anbernic, chipone and ili9488 panels Changes in v2: - include drm_of.h in all drivers to make sure the new symbol is defined Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260701121055.192475-4-tzimmermann@suse.de
2026-07-08drm/sysfb: simpledrm: Read panel orientation from DT nodeThomas Zimmermann
A device-tree panel node can specify the panel's rotation in steps of 90 degrees. Set the DRM connector orientation accordingly. Use UNKNOWN for the orientation if the field is missing or invalid. v3: - read the orientation with drm_of_get_panel_orientation() (Thierry) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260701121055.192475-3-tzimmermann@suse.de
2026-07-08drm/of: Implement drm_of_get_panel_orientation()Thomas Zimmermann
Implement drm_of_get_panel_orientation() to retrieve a panel's rotation property as enum drm_panel_orientation. The code has been taken from of_drm_get_panel_orientation(), so convert that helper over. Callers of the old helper can be converted as well. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260701121055.192475-2-tzimmermann@suse.de
2026-07-08Merge drm/drm-next into drm-misc-nextThomas Zimmermann
Backmerging to get updates from v7.2-rc2 into drm-misc-next. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2026-07-08drm/i915/display: Skip TRANS_VTOTAL.Vtotal write on NVL pre-C0Suraj Kandpal
On Nova Lake A/B steppings the GOP breaks DP-Alt / native DP output when TRANS_VTOTAL.Vtotal is programmed with a non-zero value, and the initial hardware readout of that field on such systems ends up in adjusted_mode.crtc_vtotal = 1 -- tripping the DSB scanline WARN in assert_dsl_ok() during intel_initial_commit. Keep TRANS_VTOTAL.Vtotal at 0 on Nova Lake pre-C0 (A0..B3) in both transcoder timing paths, and restore adjusted_mode.crtc_vtotal from TRANS_VRR_VMIN in intel_vrr_get_config() so downstream state stays consistent. Fixes: f26a8df8dff9 ("drm/i915/display: Program TRANS_VTOTAL from mode vtotal") Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260703032653.2122784-1-suraj.kandpal@intel.com
2026-07-08drm/i915/guc: Return NULL for missing multi-lrc parentLinmao Li
multi_lrc_create_parent() returns ERR_PTR(0) when there are not enough engines in the class to create a parallel context. ERR_PTR(0) evaluates to NULL, and the only caller already treats NULL as the non-error "not enough engines" case. Return NULL directly to make the non-error path explicit. Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260706071412.559909-1-lilinmao@kylinos.cn
2026-07-07drm/v3d: Reject invalid indirect BO handle in indirect CSD setupMaíra Canal
v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time. Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com> Link: https://patch.msgid.link/20260703-v3d-cpu-job-fixes-v3-2-bc51b1f3eeb5@igalia.com
2026-07-07drm/v3d: Use write_to_buffer() helper in performance query copyMaíra Canal
The copy of performance query results to the output buffer open-codes the 32-bit/64-bit selection with two nearly identical loops. As the write_to_buffer() helper already encapsulates the do_64bit decision, use it instead of open-coding it. Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260703-v3d-cpu-job-fixes-v3-3-bc51b1f3eeb5@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-07-07drm/v3d: Serialize jobs across queues when a perfmon is attachedMaíra Canal
A non-global perfmon is meant to count events generated by a specific submission, but the scheduler can run jobs from different queues concurrently on the same V3D core. Without explicit serialization, an unrelated job running in parallel with a perfmon-carrying job pollutes the counters and generates unusable results. To address such issue, we must enforce cross-queue serialization when we detect a perfmon-carrying submission. It's possible to implement serialization by enforcing two rules: 1. A job that carries a non-global perfmon must wait for every job currently in-flight across all HW queues to finish. 2. While a perfmon-carrying job is still in-flight, all subsequently submitted jobs must wait for it. Note that serialization is not needed in the global perfmon case, as the global perfmon tracks activity from all jobs, so concurrency is desirable. Therefore, check if serialization is needed during job submission and if so, attach fence dependences to enforce cross-queue serialization. Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260706-v3d-perfmon-lifetime-v4-2-d7b312ff2c83@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-07-07drm/v3d: Refactor perfmon lockingMaíra Canal
v3d exposes a single set of performance counters per core, so at any moment at most one performance monitor can be programmed in HW. In software, this singleton is represented by v3d_dev->active_perfmon, but until now nothing actually serialized access to it: scheduler callbacks, the GPU-reset path, and perfmon ioctls all read and wrote that field lock-free. The existence of v3d_perfmon->lock mutex did not close the gap. It serialized start/stop of *one* perfmon object against itself, but the invariant that needs protection is device-wide: there can be exactly one active perfmon at any moment in HW. Two threads acting on different perfmon objects could race through v3d_dev->active_perfmon and the counter registers, leaving software and HW out of sync. This commit moves the locking to where the invariant actually lives. Group the active perfmon pointer with a device-wide spinlock and route every state transition (job start, job completion, set global, reset, suspend/resume, destruction) through a small set of locked entry points that are the only mutators of the HW counters. Some design improvements needed to be made for the refactor: 1. Stop the perfmon from the IRQ handler at job-completion time (the natural boundary for "active perfmon follows the active job"). This required a change from a mutex to a spinlock. This solves another issue of the existing design: perfmon start/stop was exclusively attached to run_job() callbacks, which means that if nothing was further queued up, a perfmon would never actually be stopped. 2. Pause/resume the HW counters across runtime-PM transitions without dropping the software reference. This preserves the perfmon state while the device is idle. 3. Move the global perfmon lifecycle management to the set_global IOCTL. This simplifies the logic in v3d_perfmon_start() and v3d_perfmon_stop(), as there is no need to always check if the global perfmon is enabled. 4. v3d_perfmon_get_values_ioctl() doesn't stop the perfmon when capturing the values. All lifecycle management is handled by the job (for per-job perfmons) or the set_global IOCTL (for global perfmons). Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260706-v3d-perfmon-lifetime-v4-1-d7b312ff2c83@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-07-07drm/syncobj: Use kmalloc_objs for chainsJonathan Cavitt
Use kmalloc_objs instead of kmalloc_array when initializing chains in drm_syncobj_timeline_signal_ioctl. Concern caught by static analysis. Suggested-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com> Cc: Tobias Hector <Tobias.Hector@amd.com> Cc: Jason Ekstrand <jason@jlekstrand.net> Cc: Dave Airlie <airlied@redhat.com> Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Chunming Zhou <david1.zhou@amd.com> Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> Reviewed-by: Christian König <christian.koenig@amd.com> Link: https://patch.msgid.link/20260701143111.1410442-1-jonathan.cavitt@intel.com
2026-07-07drm/exec: Use kvmalloc_objs for exec->objectsJonathan Cavitt
Use kvmalloc_objs instead of kvmalloc_array when initializing exec->objects in drm_exec_init. Concern caught by static analysis. Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com> Cc: Rob Clark <robdclark@chromium.org> Cc: Christian König <christian.koenig@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Link: https://patch.msgid.link/20260701172458.1416930-1-jonathan.cavitt@intel.com
2026-07-07drm: Guard DRM_CLIENT_CAP_PLANE_COLOR_PIPELINERobert Mader
The client cap is currently advertised unconditionally, even for drivers that do not support plane color pipelines. If clients supporting the latter, like Wayland compositors or tools like drm_info, enable the client cap on such drivers they will be left without both color pipeline and the legacy properties COLOR_ENCODING and COLOR_RANGE, effectively breaking YUV->RGB conversion support. Prevent that by only marking the cap supported if there are actually planes with color pipelines. Note: while the color pipeline replacement for the legacy properties is still under review (1), we can assume that it will work as a drop-in replacement. That means any plane on any hardware currently supporting the legacy properties will be able to offer a functionally equal color pipeline and there will be no technical reason keep using the legacy properties if both the driver and the client support the new API. [1] https://lore.kernel.org/dri-devel/20260623164812.81110-1-harry.wentland@amd.com/ Signed-off-by: Robert Mader <robert.mader@collabora.com> Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Reviewed-by: Melissa Wen <mwen@igalia.com> Fixes: 179ab8e7d7b3 ("drm/colorop: Introduce DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE") Link: https://patch.msgid.link/20260703073230.19982-1-robert.mader@collabora.com Suggested-by: Maarten Lankhorst <dev@lankhorst.se> Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-07-07drm/drm_exec: avoid indirect gotoChristian König
The drm_exec component uses a variable with scope limited to the for() and an indirect goto to allow instantiating multiple macros in the same function. This unfortunately doesn't work well with certain compilers when the indirect goto can't be lowered to a direct jump. Switch the indirect goto to a direct goto, the drawback is that we now can't use the dma_exec_until_all_locked() macro in the same function multiple times. The is currently only one user of this and only as a hacky workaround which is about to be removed. So document that the __label__ statement should be used when the macro is used multiple times and fix the tests and the only use case where that is necessary. Suggested-by: Peter Zijlstra <peterz@infradead.org> Signed-off-by: Christian König <christian.koenig@amd.com> Fixes: 9920249a5288 ("drm/amdgpu: convert amdgpu_vm_lock_by_pasid() to drm_exec") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202606231854.7LeCtlLe-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202606232356.gwHMAJAW-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202606240753.kYjobJVl-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202606241110.iUga5vVw-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202607031446.1PWG18mN-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202607031837.HSmBj8pr-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202607040159.GopyEswS-lkp@intel.com/ Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Link: https://lore.kernel.org/r/20260704084133.122053-1-christian.koenig@amd.com
2026-07-07Merge tag 'amd-drm-next-7.3-2026-07-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/agd5f/linux into drm-next [airlied: had to reapply drm/amdgpu: Implement "color format" DRM property by hand to amdgpu_dm_connector.c] amd-drm-next-7.3-2026-07-02: amdgpu: - Queue reset updates - Initial compute pipe reset support - Improved boundary checking for bios parsing - Cleaned up sysfs input parsing - devcoredump fixes - RAS updates and rework - VCN secure submission fixes - 8K panel fix - Add display KUnit tests - Display CRC fixes - UserQ updates - Backlight fixes - Parse panel type info from DisplayID - Align IP discovery to pci device lifetime - IOCTL boundary check fixes - Convert amdgpu_vm_lock_by_pasid() to drm_exec - Ctx fixes and cleanup - SOC15 register macro cleanups - Memory placement fixes for UVD - Disable KQ support for MI3xx - GFX9 mode2 reset fix - BO list cleanup - Soc24 aborted suspend fix - Gfx8 soft reset rework - Enable soft reset on gfx8 - Drop unnecessary BUG() and BUG_ON() in error paths - Fix power reporting unit conversion - Improve vbios command table bounds checking - UVD bounds checking improvements - VCN bounds checking improvements - PSR and replay fixes - DCN 4.2 updates - Colorop updates - DC GPIO rework - ACP fixes - Fix aperture mapping leak - Ignore_damage_clips fix - Fixes for non-4K pages - JPEG idle check fixes - Userptr fixes - GPUVM fixes - GC 11.7 updates - SMU 13 fixes amdkfd: - Initial compute pipe reset support - Allow applications to opt out of sigbus on fatal errors - Fix doorbell/mmio BO cleanup - Improved CRIU boundary checking - MQD handling rework - SMI fixes - Reset event fixes - CRIU fixes - Sysfs teardown fixes - IOCTL boundary check fixes - SVM fixes - Soft IH ring fixes - Move TBA/TMA from system to device memory radeon: - Blit fix for large BOs - r600 dpm cleanup fix drm: - Extract EDID base section header processing into helper - Parse panel type from DisplayID 2.x Display Parameters UAPI: - KFD interface for applications to select sigbus behavior on fatal errors Proposed userspace: https://github.com/ROCm/rocm-systems/pull/6190 From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260702141515.67919-1-alexander.deucher@amd.com Signed-off-by: Dave Airlie <airlied@redhat.com>
2026-07-07Merge tag 'drm-xe-next-2026-07-03' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - Add additional error components to xe drm_ras (Riana) - Drop 'force_execlist' module parameter (Roper) Cross-subsystem Changes: - Perf events: Export perf_allow_{cpu,tracepoint} to be used by Xe (John) Display Changes: - Skip FORCE_WC and vm_bound check for external dma-bufs (Auld) Driver Changes: - Gate observation streams with perf_allow_cpu (John Hubbard) - Documentation updates and fixes (Michal, Zhan) - Remove unreleased NVL-S GuC (Daniele) - Fix pcode init path (Michal) - RTP fixes and improvements (Gustavo, Violet, Thomas, Roper) - TLB invalidation fixes and improvements (Tilak) - PXP detachment from HuC for newer platforms (Daniele) - Multi-queue fix (Niranjana) - Improve Kconfig.profile help (Rodrigo) - Xe_drm_ras and hw_error updates and fixes (Raag, Riana) - NVL-S updated PCI-IDs and W/a (Gustavo, Nitin) - Fix dma_fence refcound (Wentao) - Madvise: optimize invalidation path (Arvind) - Fix a infinite gt-reset loop in the timeout recovery (Rodrigo) - Fix wa_oob codegen recipe for external module builds (Thomas) - Avoid global forcewake in cycle query path (Xin) - Update TTM device benefical_order (Brost) - Fix buffer overflow in guc capture (Tejas) - Page-table fixes and improvements (Brian, Francois, Auld, Brost) - Removing redundant check (Lu) - General MCR and MMIO clean-up and improvements (Michal) - Don't whitelist OA registers unconditionally (Ashutosh) - SVM error return fix (Brost) - Userptr fix and small related clean-ups (Shuicheng) - Don't attempt to process FAST_REQ or EVENT relays on PF (Michal) - Couple fdinfo improvements (Auld) - Drop manual VF check on i2c (Raag) - Probe info outside of xe_info_init functions (Gustavo) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/akf7xr96MI4Rd6Qj@intel.com
2026-07-06x86/cpu: Hide and rename static_cpu_has()Borislav Petkov (AMD)
cpu_feature_enabled() is the one to use to test feature flags so hide the static thing which doesn't pay attention to disabled mask bits anyway. Use the following command to do the replacement: $ git grep --files-with-matches -w static_cpu_has -- ':(exclude)*cpufeature.h' \ | xargs sed -i 's/static_cpu_has(/cpu_feature_enabled\(/g' There should be no functional changes resulting from this. Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Nikolay Borisov <nik.borisov@suse.com> Link: https://patch.msgid.link/20260620015041.336288-1-bp@kernel.org