summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-07-01drm/amdgpu: reject mapping a reserved doorbell to a new queueZhu Lingshan
When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using xa_store_irq() to store a doorbell, which allows a later queue created with the same BO and offset parameters to overwrite an existing queue and doorbell mapping. This can cause problems like misrouting fence IRQ processing to a wrong queue, and mislead the cleanup process of one queue erasing the mapping of another queue. This commit fixes this issue by replacing xa_store_irq with xa_insert_irq, which rejects mapping a reserved doorbell to a newly created queue Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: protect XCP scheduler selectionXiang Liu
amdgpu_xcp_select_scheds() reads the per-XCP scheduler list. Partition switching rebuilds the same table under xcp_lock. Take xcp_lock around XCP scheduler selection and release. This prevents readers from observing partially rebuilt state. Also revalidate the selected XCP id before indexing the table. An open file can outlive a switch to another partition mode. Signed-off-by: Xiang Liu <xiang.liu@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookupAsad Kamal
vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL when any index is out of range. Fixes: f83a9991648b ("drm/amd/powerplay: add Vega10 powerplay support (v5)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookupAsad Kamal
vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of range. Fixes: c82baa281843 ("drm/amd/powerplay: add Tonga dpm support (v3)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate Tonga PPTable subtable boundsYang Wang
v1: Tonga PPTable parsing also relies on VBIOS offsets, revision fields and entry counts for several subtables. Malformed data can cause out-of-bounds reads, while voltage lookup tables can overrun their fixed-size destination arrays. Add common bounds helpers and validate fixed subtables, dynamic entry arrays and revision-specific layouts before consuming voltage lookup, dependency, PCIE, power-tune, hard-limit, thermal, fan, GPIO, PPM and VCE state data. v2: correct to handle get_tonga_ppm_table() return value. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate Vega10 PPTable subtable boundsYang Wang
v1: Vega10 PPTable parsing uses VBIOS-provided offsets, revision fields and entry counts to locate subtables. Malformed data can otherwise drive out-of-bounds reads from soft_pp_table_size, and voltage lookup tables can overrun their fixed-size destination arrays. Add shared bounds helpers and validate fixed-size subtables, dynamic entry arrays and revision-specific layouts before consuming thermal, fan, power-tune, clock dependency, PCIE, hard-limit and voltage lookup data. v2: if ucRevId is not matched, fallback to default table size instead of returning -EINVAL. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate legacy hwmgr PP table offsetsYang Wang
processpptables.c walks several variable-length PPLIB tables by using offsets from the VBIOS PowerPlay table. Some paths dereference extended headers, state arrays, clock arrays, non-clock arrays, or VCE records before checking that the referenced data is inside the table buffer. Add local bounds helpers and validate the relevant offsets and entry sizes before dereferencing them. This prevents truncated or malformed legacy PowerPlay tables from driving out-of-bounds reads during hwmgr initialization and table entry lookup. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate Vega hwmgr PowerPlay table boundsYang Wang
The Vega hwmgr PowerPlay table parsers read fixed table fields, state array entries, or SMC PPT fields before validating that the VBIOS table buffer covers those structures. A truncated table can therefore lead to out-of-bounds reads during hwmgr initialization. Reject tables smaller than the fixed PowerPlay table. For Vega10, also validate the state array offset and entry range before dereferencing the state array. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate Tonga PowerPlay state array boundsYang Wang
process_pptables_v1_0.c builds the Tonga state array pointer from usStateArrayOffset before checking that the table buffer covers the referenced data. A truncated PowerPlay table can therefore lead to out-of-bounds reads while validating the state array. Validate the fixed table size first, then check the state array offset and entry range before dereferencing the state array. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Remove unnecessary SIGNAL_TYPE_HDMI_TYPE_A checkWerner Sembach
Remove unnecessary SIGNAL_TYPE_HDMI_TYPE_A check that was performed in the drm_mode_is_420_only() case, but not in the drm_mode_is_420_also() && force_yuv420_output case. Without further knowledge if YCbCr 4:2:0 is supported outside of HDMI, there is no reason to use RGB when the display reports drm_mode_is_420_only() even on a non HDMI connection. This patch also moves both checks in the same if-case. This eliminates an extra else-if-case. Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Signed-off-by: Andri Yngvason <andri@yngvason.is> Tested-by: Andri Yngvason <andri@yngvason.is> Reviewed-by: Daniel Stone <daniel@fooishbar.org> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Handle struct drm_plane_state.ignore_damage_clipsThomas Zimmermann
The mode-setting pipeline can disabled damage clippings for a commit by setting ignore_damage_clips in struct drm_plane_state. The commit will then do a full display update. Test the flag in DCN code and do a full update in DCN code if it has been set. Commit 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers to ignore damage clips") introduced ignore_damage_clips to selectively ignore damage clipping in certain framebuffer changes. This driver does not do that, but DRM's damage iterator will soon rely on the flag. Therefore supporting it here as well make sense for consistency. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers to ignore damage clips") Cc: Javier Martinez Canillas <javierm@redhat.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Zack Rusin <zackr@vmware.com> Cc: dri-devel@lists.freedesktop.org Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/pm/powerplay: clamp Vega10 PP sub-table ucNumEntriesAsad Kamal
Same write-OOB and read-OOB as the Tonga fix, across seven Vega10 sub-table parsers: get_vddc_lookup_table(), get_mm_clock_voltage_table(), get_socclk/mclk/gfxclk/pixclk/dcefclk_voltage_dependency_table(). The GFXCLK table selects the correct record size per revision. Fixes: f83a9991648b ("drm/amd/powerplay: add Vega10 powerplay support (v5)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/pm/powerplay: clamp Tonga/Polaris PP sub-table ucNumEntriesAsad Kamal
ucNumEntries in the Tonga/Polaris PowerPlay sub-tables is used as both the kzalloc count and loop bound without validation, allowing a crafted VBIOS to overflow the destination heap object and read past the VBIOS image. Clamp via pp_entries_max() in get_vddc_lookup_table(), get_mclk_voltage_dependency_table(), get_sclk_voltage_dependency_table() and get_mm_clock_voltage_table(). Fixes: c82baa281843 ("drm/amd/powerplay: add Tonga dpm support (v3)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/pm: add pp_entries_max() helperAsad Kamal
Add a static inline that returns the maximum safe record count for a PowerPlay sub-table, bounded by the lesser of soft_pp_table_size and adev->bios_size. Uses adev->bios directly to avoid a dependency on struct atom_context. Subsequent patches use it to clamp ucNumEntries. Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB readAsad Kamal
Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read when the VBIOS supplies a malformed VoltageObjectInfo table. Fixes: c82baa281843 ("drm/amd/powerplay: add Tonga dpm support (v3)") Fixes: 0d2c7569e196 ("drm/amdgpu: add new atomfirmware based helpers for powerplay") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Yang Wang <kevinyang.wang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO sizeYongqiang Sun
CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the HW field is larger than the queue's control stack allocation, memcpy reads past the BO into adjacent GTT memory and can leak kernel data to userspace. Store the page-aligned control stack BO size in mqd_manager and clamp checkpoint copies and reported checkpoint sizes to min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound for multi-XCC v9.4.3 checkpoint layout. Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com> Reviewed-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: fix aperture mapping leakAsad Kamal
amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to always return false, so iounmap(aper_base_kaddr) never runs on normal driver unload, leaving an orphaned entry in the x86 PAT interval tree. On connected_to_cpu hardware, the aperture is mapped write-back (WB) via ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC) over the same range. The WC vs WB conflict causes: ioremap error for 0x..., requested 0x1, got 0x0 amdgpu: discovery failed: -2 Fix by switching to devres-managed mappings so cleanup is guaranteed regardless of drm_dev_enter() state: - connected_to_cpu path: devm_memremap(MEMREMAP_WB). For IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut, returning __va(offset) from the existing kernel direct map. No new ioremap VA or PAT entry is created, so there is nothing to orphan. - dGPU path: devm_ioremap_wc() registers iounmap() as a devres action, guaranteeing cleanup at device_del() time. Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio() since the mapping is now devres-owned. v2: Remove redundant x86_64 guard (Lijo) Fixes: 9d0af8b4def0 ("drm/amdgpu: pre-map device buffer as cached for A+A config") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: add check for xcp idGangliang Xie
check sel_xcp_id before its use Signed-off-by: Gangliang Xie <ganglxie@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Use uploaded size for legacy custom PPTableYang Wang
The legacy powerplay path used to allocate hardcode_pp_table from the original VBIOS PPTable size, copy only the uploaded bytes into it, and keep soft_pp_table_size unchanged. If a custom PPTable is shorter than the original table, later code can still treat the stale tail as valid table data. Treat the uploaded buffer as the complete custom PPTable: duplicate the uploaded buffer directly, replace hardcode_pp_table atomically, and set soft_pp_table_size to the uploaded size. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate pp_table header before reading sizeYang Wang
smu_sys_set_pp_table() reads usStructureSize from the uploaded pp_table buffer before validating that the buffer contains a complete ATOM_COMMON_TABLE_HEADER. A short write can therefore make the driver read past the supplied sysfs buffer. Reject empty or header-short uploads before dereferencing the header pointer. Keep the existing structure-size check for the full uploaded table. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdkfd: Add gfx12.0 queue reset support to topologyAmber Lin
This adds queue reset support in KFD topology for gfx12.0.0 and gfx12.0.1 on non-sriov mode. Signed-off-by: Amber Lin <amber.lin@amd.com> Reviewed-by: Shaoyun Liu <shaoyun.liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01Revert "drm/amdkfd: Add queue reset support to gfx12.0"Amber Lin
This reverts commit 96d745011842e906774aa8523abb78775b008a4e. This patch didn't exclude SRIOV Signed-off-by: Amber Lin <Amber.Lin@amd.com> Reviewed-by: Jesse Zhang <jesse.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userqJesse Zhang
Try KQ by ring_id first (KCQ and UQ never share a HW slot); fall back to amdgpu_userq_process_fence_irq() on miss, since KCQ EOPs were misrouted into the userq fence path when enable_mes is true. Require a strict (me,pipe,queue) match in the gfx case, then userq gfx EOPs fall through to amdgpu_userq_process_fence_irq(). Suggested-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userqJesse Zhang
Try KQ by ring_id first (KCQ and UQ never share a HW slot); fall back to amdgpu_userq_process_fence_irq() on miss, since KQ EOPs were misrouted into the userq fence path when enable_mes is true. Require a strict (me,pipe,queue) match in the gfx case, then userq gfx EOPs fall through to amdgpu_userq_process_fence_irq(). Suggested-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/gfx12: handle error interrupts for userqsJesse Zhang
Call the new userq reset helper, and dispatch KQs first by ring_id before falling back to the user-queue lookup. v2: squash in fixes Co-developed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: invoke pm_genpd_remove() before freeing genpdCe Sun
Call pm_genpd_remove() to unregister from global list prior to releasing acp_genpd memory, and clear the pointer after free. Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: fix resource leak on ACP reset timeoutCe Sun
When ACP soft reset poll times out, original code returns early without cleanup, leaking MFD child devices, genpd links and all ACP heap allocations. Replace direct early return with goto out to force run all cleanup logic regardless of reset success, preserve timeout error code for caller. Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: use halving distribution for PQ/sRGB linearizing LUTMelissa Wen
When linearizing, the input is an encoded signal bounded to [0,1] and PQ/sRGB EOTFs are steepest near 1, requiring more precision near the bright end. Take the 8-bit sRGB case as a reference: 256 possible inputs and 256 HW LUT points line up, so the LUT acts as plain indexing. Float representations don't land perfectly, but LERP-ing between two HW entries, when input is within a small epsilon of one of them, doesn't materially change the result. Replace the uniform 12-region distribution (16 points each, 192 total, range [2^-12, 1]) with a 9-region halving distribution for the PQ/sRGB pre-defined EOTF: 128 points in the top region [0.5, 1], 64 in the next, 32 in the next, and so on, down to 1 point in each of the two darkest regions. Total samples grow from 192 to 256, with uniform 1/256 spacing across [0, 1]. The dark tail below 2^-9 is no longer sampled separately, which is acceptable for PQ/sRGB. Suggested-by: Krunoslav Kovac <Krunoslav.Kovac@amd.com> Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: support up to 256 samples per region in degamma/blend LUTMelissa Wen
cm3_helper_translate_curve_to_degamma_hw_format() reads one tf_pts entry per HW LUT point, limiting the number of samples per region to NUMBER_SW_SEGMENTS (16, at seg_distr[k] = 4) - higher seg_distr[k] underflows the increment to 0. But the next patch introduces a halving distribution for PQ/sRGB EOTFs that requires up to 128 samples in its upper region (seg_distr[k] = 7). As preparation, extend the loop index by 4 bits and linearly interpolate adjacent tf_pts entries with the new interp_tf_pts() helper, where the 4 least significant bits are weight in 1/16 increments. This raises the cap to 256 samples per region (seg_distr[k] = 8). seg_distr[k] <= 4 paths remain unchanged: the 4 least significant bits remain zero and interp_tf_pts() reduces to a direct lookup. Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Co-developed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: use a separate helper to translate degamma curvesMelissa Wen
In newer DCN families, there is no hw predefined curves for shaper, blend and regamma. When userspace sets pre-defined curves for these blocks, the driver uses AMD color module to program predefined curve as LUT. However, it was using the same LUT segmentation for EOTF and inverse EOTF by using the same color management helper. This is causing banding on blend when PQ predefined curve is set. Besides that, degamma predefined HW curve cannot be used with subsampled 4:2:0/4:2:2 formats as it affects the linearity of color space in which HW scaler operates. To mitigate banding when using the blend block and better support subsampled format on degamma, use different translation helpers when linearizing and delinearizing. Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01Revert "drm/amd/display: Remove unused ↵Melissa Wen
cm3_helper_translate_curve_to_degamma_hw_format" This reverts commit 8b89acc0b2baecfe331f5336e7ff1fcc5a44b062. So that we can detach NL->L LUT programming from L->NL one, i.e., we can use cm3_helper_translate_curve_to_degamma_hw_format for plane degamma and blend (post-3DLUT curve) and cm3_helper_translate_curve_to_hw_format for plane shaper (pre-3DLUT curve) and stream regamma. Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: use GAMCOR for degamma private props in subsampled formatMelissa Wen
When setting plane degamma TF via AMD driver-specific color properties, the driver uses PRE_DEGAM color block (ROM). However, this block cannot be used with subsampled formats as it affects the linearity of color space in which HW scaler operates. For subsampled format, use the AMD color module to map plane degamma predefined curve to LUT and use GAMCOR block instead (RAM). This is based on Harry's implementation for Fixed Matrix Colorop. Link: https://lore.kernel.org/dri-devel/20260330153451.99472-1-harry.wentland@amd.com/ Co-developed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: don't free standalone ip_discovery sysfs in sysfs_finiMario Limonciello
The standalone_mode ip_discovery sysfs hierarchy is tied to the PCI device lifetime and tracked in early_ip_discovery_list. It is torn down only by amdgpu_discovery_sysfs_early_fini() on driver unbind, which is why amdgpu_discovery_fini() already guards its teardown with !standalone_mode. Commit 7de02fe95312 ("drm/amdgpu: clean up discovery and preempt sysfs entries on shutdown") added an unconditional amdgpu_discovery_sysfs_fini() call in amdgpu_device_sys_interface_fini(), which runs during amdgpu_device_fini_hw() on every unbind/reload. On reload this freed the PCI-device-owned ip_top via kobject_put()->ip_disc_release()->kfree(), leaving a dangling pointer in early_ip_discovery_list. The subsequent amdgpu_discovery_sysfs_early_fini() then dereferenced and put the freed object, causing a use-after-free and double-free, and prematurely destroyed the sysfs that was meant to persist across reloads. Make amdgpu_discovery_sysfs_fini() skip standalone_mode objects so the invariant is centralized at the teardown site and the new call site cannot free the PCI-device-owned ip_top. Teardown of standalone sysfs remains the sole responsibility of amdgpu_discovery_sysfs_early_fini(). Fixes: 7de02fe95312 ("drm/amdgpu: clean up discovery and preempt sysfs entries on shutdown") Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdkfd: avoid race condition of mqd when reading sdma counterEric Huang
MQD used outside of dpm_lock is unsafe because the queue could be destroyed during the window of dqm_unlock, moving into dqm_lock range is the best practice. Signed-off-by: Eric Huang <jinhuieric.huang@amd.com> Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: convert dcn42 GPIO translation to lookup tablesGuilherme Ivo Bozi
Replace dcn42 GPIO translation switch statements with the generic table-based translation helpers. This simplifies the GPIO mapping logic and reduces duplicated translation code. No functional changes intended. Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: convert dcn401 GPIO translation to lookup tablesGuilherme Ivo Bozi
Replace dcn401 GPIO translation switch statements with the generic table-based translation helpers. This simplifies the GPIO mapping logic and reduces duplicated translation code. No functional changes intended. Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: convert dcn32 GPIO translation to lookup tablesGuilherme Ivo Bozi
Replace dcn32 GPIO translation switch statements with the generic table-based translation helpers. This simplifies the GPIO mapping logic and reduces duplicated translation code. No functional changes intended. Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: convert dcn315 GPIO translation to lookup tablesGuilherme Ivo Bozi
Replace dcn315 GPIO translation switch statements with the generic table-based translation helpers. This simplifies the GPIO mapping logic and reduces duplicated translation code. No functional changes intended. Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: convert dcn30 GPIO translation to lookup tablesGuilherme Ivo Bozi
Replace dcn30 GPIO translation switch statements with the generic table-based translation helpers. This simplifies the GPIO mapping logic and reduces duplicated translation code. No functional changes intended. Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: convert dcn21 GPIO translation to lookup tablesGuilherme Ivo Bozi
Replace dcn21 GPIO translation switch statements with the generic table-based translation helpers. This simplifies the GPIO mapping logic and reduces duplicated translation code. No functional changes intended. Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: convert dcn20 GPIO translation to lookup tablesGuilherme Ivo Bozi
Replace dcn20 GPIO translation switch statements with the generic table-based translation helpers. This simplifies the GPIO mapping logic and reduces duplicated translation code. No functional changes intended. Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: convert dcn10 GPIO translation to lookup tablesGuilherme Ivo Bozi
Replace dcn10 GPIO translation switch statements with the generic table-based translation helpers. This simplifies the GPIO mapping logic and reduces duplicated translation code. No functional changes intended. Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: add GPIO HW translation helpersGuilherme Ivo Bozi
Add generic helpers and lookup table types for GPIO hardware translation. The new helpers provide reusable conversions between GPIO IDs, register offsets and DDC lines, allowing ASIC-specific drivers to replace large switch statements with static lookup tables. No functional changes intended. Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: remove check for nonexistent CONFIG_HAVE_KGDBEthan Nelson-Moore
drivers/gpu/drm/amd/display/dc/sspl/spl_debug.h checks for CONFIG_HAVE_KGDB or CONFIG_KGDB to determine whether to call kgdb_breakpoint(). CONFIG_HAVE_KGDB has never existed in the kernel. Remove the check for it and retain only the correct check for CONFIG_KGDB. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: avoid large stack allocation in ↵Arnd Bergmann
commit_planes_do_stream_update_sequence The function has two arrays on the stack to hold temporary dsc_optc_config and dsc_config objects. The combination blows through common stack frame warning limits in combination with the other local variables: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4070:22: error: stack frame size (1352) exceeds limit (1280) in 'commit_planes_do_stream_update_sequence' [-Werror,-Wframe-larger-than] Since neither array is initialized or used outside of the add_link_update_dsc_config_sequence() function, there is no actual need to keep each element around. Replace the arrays with a single instance each to reduce the stack usage to less than half. Fixes: 9f49d3cd7e71 ("drm/amd/display: Implement block sequencing infrastructure for modular hardware operations.") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Remove redundant IPS mode case for DCN 4.2Alex Hung
[WHAT] Remove the redundant IP_VERSION(4, 2, 0) case from dm_get_default_ips_mode() since it only reassigns the same DMUB_IPS_ENABLE value already set at initialization. Also remove the corresponding KUnit test. Reviewed-by: Chenyu Chen <chen-yu.chen@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Promote DC to 3.2.387Taimur Hassan
DC Automatic Code Cutoff Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: [FW Promotion] Release 0.1.64.0Taimur Hassan
Added panel polarity feature Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Add Debug Option To Enable Per-DPM De-rate UsageAustin Zheng
[Why] DML has been updated to use per-DPM derates when provided but per-DPM de-rates have not been finalized. Need to validate to see what values should be stored in the bounding box. [How] Add debug options to set custom derates per DPM (starting at DPM0) and their values Each entry in the custom derate expects the derates to be stored in the following format: bits 0-7: dram_derate_percent_pixel bits 8-15: fclk_derate_percent bits 16-23: dcfclk_derate_percent bits 24-31 are unused. e.g. Using the value 0x414020 will set the following derates for DPM0 DPM0: 0x20, 0x40, 0x41 for dram, fclk, and dcfclk respectively Note that global derate value will be used if the per-DPM derate is 0. Reviewed-by: Jun Lei <jun.lei@amd.com> Signed-off-by: Austin Zheng <Austin.Zheng@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Refactor Driver PG's skip PG logicLeo Chen
[Why & How] When driver allows idle optimization, no HW state should be modified further by DC. Refactor the skip PG logic in pg_cntl in DCN42. Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com> Signed-off-by: Leo Chen <leo.chen@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>