summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-01drm/amd/display: revert "Enable HUBP/DPP power gate for DCN42"Leo Chen
[why] Disabling HUBP/DPP Driver PG as it's causing corruption issues. This reverts commit 8b6ab8bdf835efb91c1d782b7c2cf32dad39238f. Reviewed-by: Charlene Liu <charlene.liu@amd.com> Signed-off-by: Leo Chen <leo.chen@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Disable mem gating for DCHVM on DCHVM initAndrew Lichmanov
[Why] Hang occurs with global gating enabled if req=1 Reviewed-by: Leo Chen <leo.chen@amd.com> Signed-off-by: Andrew Lichmanov <Andrew.Lichmanov@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: remove dead code related to forcevrrCharlene Liu
[why] remove the forcevrr related which are not used any more. Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com> Signed-off-by: Charlene Liu <Charlene.Liu@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Extract shared KUnit test helpersAlex Hung
Extract common allocation and setup patterns from KUnit test files into a dedicated helpers module to reduce duplication. Add tests/amdgpu_dm_kunit_helpers.c with shared helpers: - dm_kunit_alloc_adev: allocate amdgpu_device via DRM mock - dm_kunit_alloc_link: allocate zeroed dc_link - dm_kunit_alloc_link_with_ctx: allocate dc_link with dc_context - dm_kunit_alloc_dm: allocate display_manager with DC state - dm_kunit_alloc_stream: allocate dc_stream_state with link - dm_kunit_add_stream_to_state: wire stream into dc_state - dm_kunit_alloc_connector: allocate connector wired to device Update 10 test files to use the shared helpers, removing duplicated local alloc_test_adev, alloc_test_link, alloc_test_dm, alloc_test_stream, and add_test_stream functions. Add missing MODULE_DESCRIPTION() macro to suppress modpost warning: WARNING: modpost: missing MODULE_DESCRIPTION() in amdgpu_dm_kunit_helpers.o Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: hold a vblank ref while writeback is pendingHarry Wentland
Writeback completion is detected in dm_crtc_high_irq(), the CRTC vblank IRQ handler. The arm path (dm_set_writeback) never took a vblank reference, so the interrupt was only enabled incidentally (by a pageflip on the same commit, fbcon, or a previous vblank's off-delay window). A writeback-only commit right after a fresh drm_crtc_vblank_on() (e.g. a writeback connector detached and re-attached) therefore has no vblank reference: the IRQ never fires, wb_pending is never cleared and the out fence times out. This is reproducible with IGT kms_writeback and was seen via kms_colorop on writeback-capable hardware. The relevant IGT branch is at https://gitlab.freedesktop.org/hwentland/igt-gpu-tools/-/tree/yuv-fm-colorop Take a vblank reference when arming the writeback and release it once completion is signalled. The get is done before arming wb_pending so the completion IRQ cannot drop the reference before it is taken. Factor the shared completion bookkeeping into amdgpu_dm_crtc_complete_writeback() and also call it from the teardown path, so a writeback torn down while still pending signals its out fence and releases the reference instead of leaking both. Fixes: c81e13b929df ("drm/amd/display: Hande writeback request from userspace") Assisted-by: Copilot:claude-opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Add KUnit tests for mst_typesAlex Hung
Add KUnit coverage for the following MST functions: - dm_dp_aux_transfer(): native read/write, partial write, error result remapping, and HPD disconnect quirk via fake DC link service - dm_dp_aux_transfer_result(): error code translation - dm_dp_aux_fill_payload_flags(): request flag decoding - dm_mst_msg_ready_mask(): ESI mask selection - dm_mst_select_esi_dpcd(): DPCD address/length selection - dm_mst_atomic_best_encoder(): encoder selection by CRTC ID - dm_dp_mst_detect(): unregistered connector early return - dm_dp_mst_atomic_check(): no-old-CRTC early return - dm_dp_create_fake_mst_encoders(): encoder init and CRTC mask - dm_handle_mst_sideband_msg_ready_event(): idle no-ready-bits - retrieve_branch_specific_data(): branch OUI parsing - retrieve_downstream_port_device(): downstream port present - needs_dsc_aux_workaround(): DSC workaround matching - dm_mst_get_pbn_divider(): null link guard - amdgpu_dm_mst_reset_mst_connector_setting(): field reset - dm_dp_mst_is_port_support_mode(): FP-off fallback Assisted-by: Copilot:GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Add KUnit tests for amdgpu_dm_pp_smuAlex Hung
Add comprehensive KUnit test coverage for amdgpu_dm_pp_smu.c including: - Utility functions: dc_to_pp_clock_type, pp_to_dc_clock_levels, build_pm_display_cfg, get_default_clock_levels, build_wm_clock_ranges_soc15, cap_clock_levels_to_validation - DPM-backed functions: dm_pp_get_clock_levels_by_type, dm_pp_notify_wm_clock_changes, dm_pp_apply_clock_for_voltage_request, dm_pp_get_static_clocks - Raven pass-throughs: pp_rv_set_wm_ranges, pp_rv_set_pme_wa_enable, pp_rv_set_active_display_count, pp_rv_set_min_deep_sleep_dcfclk, pp_rv_set_hard_min_dcefclk_by_freq, pp_rv_set_hard_min_fclk_by_freq - Navi functions: pp_nv_set_wm_ranges, pp_nv_get_maximum_sustainable_clocks, pp_nv_get_uclk_dpm_states, pp_nv_get_dpm_clock_table - Renoir: pp_rn_get_dpm_clock_table - dm_pp_get_funcs ASIC family selection v2: squash in build fix for removed functions Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Add KUnit tests for amdgpu_dm_psrAlex Hung
[WHAT] Add Kunit tests for functions: - link_supports_psrsu() - amdgpu_dm_psr_fill_caps() - amdgpu_dm_set_psr_caps() - amdgpu_dm_psr_is_active_allowed() - amdgpu_dm_psr_set_event() Assisted-by: Copilot:GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Add KUnit tests for amdgpu_dm_replayAlex Hung
[WHAT] Add KUnit coverage for amdgpu_dm_set_replay_caps(), amdgpu_dm_link_setup_replay(), and amdgpu_dm_replay_set_event() including happy-path tests that exercise the configuration logic, coasting vtotal calculations, and early-return when replay events are already in the desired state. Assisted-by: Copilot:Claude-Opus-4.6 GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Add KUnit test for amdgpu_dm_wbAlex Hung
[WHAT] Add KUnit test with DRM mock for amdgpu_dm_wb_connector_init(). Assisted-by: Copilot:GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Revert "Add Debug Option To Enable Per-DPM De-rate Usage"Austin Zheng
Revert due to regression. This reverts commit e82936e8dad0ccbe067323fe7c4e1ae4593104f3. Reviewed-by: Martin Leung <martin.leung@amd.com> Signed-off-by: Austin Zheng <Austin.Zheng@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: guard against overflow in HDCP message dumpHarry Wentland
[Why] mod_hdcp_dump_binary_message() computed target_size (a uint32_t) as roughly byte_size * msg_size and gated the whole write on buf_size >= target_size. A large msg_size can overflow target_size, wrapping it to a small value that passes the check while the loop still writes byte_size * msg_size bytes into buf. All current callers pass small constants so this is not reachable today, but the unchecked arithmetic should be hardened. [How] Drop the overflow-prone target_size precomputation and instead bounds-check the output position on every iteration, stopping once the next entry would not leave room for the trailing terminator. This cannot overflow and, for oversized messages, dumps as much as fits rather than printing nothing. Fixes: 4c283fdac08a ("drm/amd/display: Add HDCP module") Assisted-by: Copilot:claude-opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01ASoC: Fix mixed goto and guard() usageMark Brown
bui duc phuc <phucduc.bui@gmail.com> says: These two patches fix the remaining cases of mixed goto-based error handling and cleanup helpers introduced by the recent guard() conversion patches that have already been merged for the 7.2 development cycle. The cleanup.h guidelines explicitly recommend not mixing goto with cleanup helpers in the same function. Only two functions were left in this state: - sound/soc/samsung/i2s.c: remove the goto-based error path and rely on guard(pm_runtime) for automatic cleanup. - sound/soc/ti/j721e-evm.c: restore mutex_lock()/mutex_unlock() to preserve the existing goto-based error handling. Although these cases do not trigger any build warnings or errors with Clang (W=1), they still violate the cleanup.h guidelines. These patches address those remaining cases and add the appropriate Fixes: tags for the commits that introduced them. Link: https://patch.msgid.link/20260701041310.230725-1-phucduc.bui@gmail.com
2026-07-01ASoC: ti: j721e-evm: Avoid mixing goto with guard()bui duc phuc
The previous guard(mutex) conversion mixed cleanup helpers with goto-based error handling, which is discouraged by the cleanup.h guidelines. Restore mutex_lock()/mutex_unlock() instead. Fixes: 6f4cf77320ae ("ASoC: ti: j721e-evm: Use guard() for mutex locks") Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260701041310.230725-3-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-01ASoC: samsung: i2s: Avoid mixing goto with guard()bui duc phuc
cleanup.h recommends not mixing goto-based error handling with cleanup helpers in the same function. Remove the goto path and rely on guard(pm_runtime) for automatic cleanup instead. Fixes: 3d08517b5c67 ("ASoC: samsung: i2s: Use guard() for spin locks") Signed-off-by: bui duc phuc <phucduc.bui@gmail.com> Link: https://patch.msgid.link/20260701041310.230725-2-phucduc.bui@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-01drm/amd/display: clamp DMUB AUX reply length to payload bufferHarry Wentland
[Why] amdgpu_dm_process_dmub_aux_transfer_sync() copies p_notify->aux_reply.length bytes into payload->data without clamping. payload->data is typically a 16-byte DPCD scratch buffer, while aux_reply.length is echoed from the sink via the DMUB ring. While this is clamped by DMUB it's prudent to ensure we validate this in the driver as well. [How] Clamp the copy to sizeof(aux_reply.data), the scratch buffer the reply was read into, and use that for both the memcpy and the return value. For regular transfers additionally clamp to payload->length to cover callers whose destination buffer is smaller than 16 bytes. The write-status-update retry path (dce_aux_transfer_with_retries) deliberately zeroes payload->length while still expecting the partial-write status byte, so that bound is skipped in that case to avoid dropping the reply. Also guard against a NULL payload->data. Fixes: 81927e2808be ("drm/amd/display: Support for DMUB AUX") Assisted-by: Copilot:claude-opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Add block sequence support for bandwidth programming operationsBhuvanachandra Pinninti
[why] Bandwidth clock programming build and execution phases were coupled, preventing the HWSS from orchestrating them through block sequencing. [how] Separate clock programming into build and execute phases across latest versions. Build phase populates the clk_mgr internal block sequence array, then registers a single CLK_MGR_UPDATE_CLOCKS HWSS step. Execute phase dispatches the pre-built sequence. Add HWSS operations for clk_mgr_set_max_memclk, hubbub_program_watermarks, hubbub_program_arbiter, and hubbub_program_compbuf_segments. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Bhuvanachandra Pinninti <BhuvanaChandra.Pinninti@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Cleaned up headersBhuvanachandra Pinninti
[why & how] The register spec headers are duplicated in the external asic_reg path and maintaining a local copy is unnecessary. Reviewed-by: Aric Cyr <aric.cyr@amd.com> Signed-off-by: Bhuvanachandra Pinninti <BhuvanaChandra.Pinninti@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: correct encoder minimal creationPeichen Huang
[WHY] shift and mask are not correctly initialized in create_minimal functions. [HOW] Correct initialize necessary variables. Reviewed-by: Cruise Hung <cruise.hung@amd.com> Signed-off-by: Peichen Huang <PeiChen.Huang@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Fix KUnit test crash after global alpha changeAlex Hung
[WHY] amdgpu_dm_plane_fill_blending_from_plane_state added drm_to_adev() but dm_test_fill_blending_global_alpha did not initialize plane_state->plane, causing a NULL pointer dereference. [HOW] Add an amdgpu_device and drm_plane so the plane->dev dereference is valid in the test. Fixes: 829769f1cfe8 ("drm/amd/display: scale plane global alpha to 12 bits on DCN 4.2") Cc: PingLei.Lin@amd.com Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: scale plane global alpha to 12 bits on DCN 4.2James Lin
[why] On DCN 4.2 the global alpha is reported using 12 bits (MPCC_GLOBAL_ALPHA spans bits [0:11]), whereas other ASICs such as DCN 3.1.4 use an 8-bit field (MPCC_GLOBAL_ALPHA spans bits [16:23]). The DRM plane alpha property is 16-bit and amdgpu_dm unconditionally scaled it down by >> 8, which only matches the 8-bit hardware field. On DCN 4.2 this fed a value that was 4 bits too small into the 12-bit field, so the hardware applied the wrong global alpha and the resulting blended output did not match the expected hw * alpha value. [how] Detect DCN 4.2 via amdgpu_ip_version(adev, DCE_HWIP, 0) and scale the 16-bit plane alpha by >> 4 to fill the 12-bit MPCC_GLOBAL_ALPHA field. All other ASICs keep the existing >> 8 behavior for their 8-bit field. Reviewed-by: ChiaHsuan (Tom) Chung <chiahsuan.chung@amd.com> Signed-off-by: James Lin <PingLei.Lin@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Simplify DMUB notify registrationAlex Hung
[WHAT] Use an early guard for invalid DMUB notify callback registration inputs. This keeps the same accepted and rejected cases while removing the redundant else block. Assisted-by: Copilot:GPT-5 Reviewed-by: Chen-Yu Chen <chen-yu.chen@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Simplify boolean checksAlex Hung
[WHAT] Use direct boolean in connector and IRQ code paths. This removes redundant comparisons around MST state, IRQ validation, handler removal, and DMUB notification offload without changing behavior. Assisted-by: Copilot:GPT-5 Reviewed-by: Chen-Yu Chen <chen-yu.chen@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Add kunit tests for amdgpu_dm_planeBhawanpreet Lakha
Add kunit tests for some functions in amdgpu_dm_plane. Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Add more KUnit tests for amdgpu_dm_coloropAlex Hung
[WHAT] Add KUnit coverage for amdgpu_dm_initialize_default_pipeline() using an amdgpu_device-backed DRM mock so drm_to_adev() and the DC color capability checks are exercised. Assisted-by: Copilot:GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Extract backlight helpers for KUnit testsAlex Hung
[WHAT] Extract shared backlight device index lookup and property setup into testable helpers. The duplicated bd-to-index scan in update_status/get_brightness is replaced by amdgpu_dm_backlight_get_device_index(), and the inline backlight_properties calculation is replaced by amdgpu_dm_backlight_fill_props(). Add KUnit coverage for both new helpers. Keep the runtime power_supply_is_system_supplied() call at the caller so the helpers remain pure and deterministic under test. Assisted-by: Copilot:GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Replace repeated no-native-i2c checks with ↵Wenjing Liu
force_i2c_over_aux field [Why] The compound condition checking dp_connector_no_native_i2c and no_ddc_pin was duplicated across many files, obscuring intent at every call site. [How] Add bool force_i2c_over_aux to struct dc_link, initialized once during link creation. Add link_get_ddc_aux_inst() helper to select the correct aux instance. Wire into link_service via construct_link_service_ddc(). Replace all duplicated condition checks and aux instance selection blocks with the new field and helper. No functional change. Reviewed-by: Nevenko Stupar <nevenko.stupar@amd.com> Signed-off-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Update link bwRelja Vojvodic
[Why & How] - Added link bw to switch case Reviewed-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Relja Vojvodic <Relja.Vojvodic@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdkfd: use node XCC count for v9 CRIU control stack restoreYongqiang Sun
set_queue_properties_from_criu() divided the checkpointed control stack size by NUM_XCC(adev->gfx.xcc_mask) (whole GPU), while the checkpoint size was recorded, the MQD buffer allocated, and the control stack restored using the per-node mask NUM_XCC(mm->dev->xcc_mask). On spatially partitioned GFX9.4.3 (CPX/QPX) these differ, so the per-XCC control stack size used for the restore memcpy could exceed the region sized for the MQD allocation, writing past the BO into adjacent kernel memory; it also broke legitimate restore on partitioned parts. Divide by the per-node XCC count so allocation and copy agree, leaving kfd_queue_acquire_buffers() to bound the size against the node's advertised control stack size. Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com> Reviewed-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01Revert "drm/amdgpu: defer KCQ remap until after MES resume in reset flow"Jesse Zhang
This reverts commit 36b6c723d82c07dbbeae95d5883d4ecf0a643727. It introduced a regression on gfx11: the kfd negative test failed. Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Amber Lin <Amber.Lin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdkfd: move TBA/TMA from system to device memoryJames Zhu
for GFX9.4.2 and above. -v2: keep APU with GTT allocation -v3: use dev->adev->apu_prefer_gtt instead Signed-off-by: James Zhu <James.Zhu@amd.com> Reviewed-by: Vladimir Indic <vladimir.indic@amd.com> Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com> Reviewed-by: Philip Yang <philip.yang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdkfd: Add domain parameter to kernel BO mapping functionJames Zhu
This change allows amdgpu_amdkfd_gpuvm_map_bo_to_kernel() to pin buffers in either GTT or VRAM based on caller specification, providing flexibility for different memory placement requirements across various kernel buffers. The domain parameter accepts AMDGPU_GEM_DOMAIN_GTT, AMDGPU_GEM_DOMAIN_VRAM, or their combination (GTT|VRAM) to let amdgpu_bo_pin() choose the optimal placement via amdgpu_bo_get_preferred_domain(). This flexible validation allows callers to specify their preference while delegating final placement decisions to the driver when appropriate. CPU visibility is automatically enforced by amdgpu_bo_pin() regardless of the domain parameter (see amdgpu_bo_pin() line 975-976 which sets AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED for kernel mappings). -v3: update amdgpu_amdkfd_gpuvm_map_bo_to_kernel description Signed-off-by: James Zhu <James.Zhu@amd.com> Reviewed-by: Vladimir Indic <vladimir.indic@amd.com> Reviewed-by: Philip Yang <philip.yang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: use kvzalloc to allocate struct dcHonglei Huang
struct dc has grown large over time (most of it the two inlined dc_scratch_space copies) and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual size is not fixed by the source alone, it also depends on the compiler and the .config, so it can easily cross 4 MiB, e.g. with a newer GCC or a config change. dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER, so the page allocator warns and returns NULL. dc_create() then fails, DM init fails and amdgpu probe aborts with -EINVAL: WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380 dc_create+0x38/0x660 [amdgpu] amdgpu_dm_init+0x2d9/0x510 [amdgpu] dm_hw_init+0x1b/0x90 [amdgpu] amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu] amdgpu_driver_load_kms+0x19/0x80 [amdgpu] amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu] dc_create() then returns NULL and DM init fails, which aborts the whole GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block <dm> failed -22"), leaving the display unusable. The subsequent amdgpu_irq_put() warnings during teardown are just fallout of unwinding a half-initialized device. struct dc is a software-only bookkeeping structure that is never handed to hardware DMA and is only ever kept as an opaque pointer, so it does not require physically contiguous memory. Allocate it with kvzalloc() (and free it with kvfree()) so that the allocator can fall back to vmalloc() when a contiguous allocation of that size is not available, which also avoids the MAX_PAGE_ORDER warning entirely. v2: - Rebase to amd-staging-drm-next. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5406 Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Honglei Huang <honghuan@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: bounds check VBIOS name extractionLijo Lazar
Bound atom_get_vbios_name() by the BIOS size to avoid out-of-bounds reads. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: reject mapping a reserved doorbell to a new queueZhu Lingshan
When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using xa_store_irq() to store a doorbell, which allows a later queue created with the same BO and offset parameters to overwrite an existing queue and doorbell mapping. This can cause problems like misrouting fence IRQ processing to a wrong queue, and mislead the cleanup process of one queue erasing the mapping of another queue. This commit fixes this issue by replacing xa_store_irq with xa_insert_irq, which rejects mapping a reserved doorbell to a newly created queue Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: protect XCP scheduler selectionXiang Liu
amdgpu_xcp_select_scheds() reads the per-XCP scheduler list. Partition switching rebuilds the same table under xcp_lock. Take xcp_lock around XCP scheduler selection and release. This prevents readers from observing partially rebuilt state. Also revalidate the selected XCP id before indexing the table. An open file can outlive a switch to another partition mode. Signed-off-by: Xiang Liu <xiang.liu@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookupAsad Kamal
vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL when any index is out of range. Fixes: f83a9991648b ("drm/amd/powerplay: add Vega10 powerplay support (v5)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookupAsad Kamal
vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of range. Fixes: c82baa281843 ("drm/amd/powerplay: add Tonga dpm support (v3)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate Tonga PPTable subtable boundsYang Wang
v1: Tonga PPTable parsing also relies on VBIOS offsets, revision fields and entry counts for several subtables. Malformed data can cause out-of-bounds reads, while voltage lookup tables can overrun their fixed-size destination arrays. Add common bounds helpers and validate fixed subtables, dynamic entry arrays and revision-specific layouts before consuming voltage lookup, dependency, PCIE, power-tune, hard-limit, thermal, fan, GPIO, PPM and VCE state data. v2: correct to handle get_tonga_ppm_table() return value. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate Vega10 PPTable subtable boundsYang Wang
v1: Vega10 PPTable parsing uses VBIOS-provided offsets, revision fields and entry counts to locate subtables. Malformed data can otherwise drive out-of-bounds reads from soft_pp_table_size, and voltage lookup tables can overrun their fixed-size destination arrays. Add shared bounds helpers and validate fixed-size subtables, dynamic entry arrays and revision-specific layouts before consuming thermal, fan, power-tune, clock dependency, PCIE, hard-limit and voltage lookup data. v2: if ucRevId is not matched, fallback to default table size instead of returning -EINVAL. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate legacy hwmgr PP table offsetsYang Wang
processpptables.c walks several variable-length PPLIB tables by using offsets from the VBIOS PowerPlay table. Some paths dereference extended headers, state arrays, clock arrays, non-clock arrays, or VCE records before checking that the referenced data is inside the table buffer. Add local bounds helpers and validate the relevant offsets and entry sizes before dereferencing them. This prevents truncated or malformed legacy PowerPlay tables from driving out-of-bounds reads during hwmgr initialization and table entry lookup. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate Vega hwmgr PowerPlay table boundsYang Wang
The Vega hwmgr PowerPlay table parsers read fixed table fields, state array entries, or SMC PPT fields before validating that the VBIOS table buffer covers those structures. A truncated table can therefore lead to out-of-bounds reads during hwmgr initialization. Reject tables smaller than the fixed PowerPlay table. For Vega10, also validate the state array offset and entry range before dereferencing the state array. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/pm: Validate Tonga PowerPlay state array boundsYang Wang
process_pptables_v1_0.c builds the Tonga state array pointer from usStateArrayOffset before checking that the table buffer covers the referenced data. A truncated PowerPlay table can therefore lead to out-of-bounds reads while validating the state array. Validate the fixed table size first, then check the state array offset and entry range before dereferencing the state array. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Remove unnecessary SIGNAL_TYPE_HDMI_TYPE_A checkWerner Sembach
Remove unnecessary SIGNAL_TYPE_HDMI_TYPE_A check that was performed in the drm_mode_is_420_only() case, but not in the drm_mode_is_420_also() && force_yuv420_output case. Without further knowledge if YCbCr 4:2:0 is supported outside of HDMI, there is no reason to use RGB when the display reports drm_mode_is_420_only() even on a non HDMI connection. This patch also moves both checks in the same if-case. This eliminates an extra else-if-case. Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Signed-off-by: Andri Yngvason <andri@yngvason.is> Tested-by: Andri Yngvason <andri@yngvason.is> Reviewed-by: Daniel Stone <daniel@fooishbar.org> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/display: Handle struct drm_plane_state.ignore_damage_clipsThomas Zimmermann
The mode-setting pipeline can disabled damage clippings for a commit by setting ignore_damage_clips in struct drm_plane_state. The commit will then do a full display update. Test the flag in DCN code and do a full update in DCN code if it has been set. Commit 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers to ignore damage clips") introduced ignore_damage_clips to selectively ignore damage clipping in certain framebuffer changes. This driver does not do that, but DRM's damage iterator will soon rely on the flag. Therefore supporting it here as well make sense for consistency. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers to ignore damage clips") Cc: Javier Martinez Canillas <javierm@redhat.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Zack Rusin <zackr@vmware.com> Cc: dri-devel@lists.freedesktop.org Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/pm/powerplay: clamp Vega10 PP sub-table ucNumEntriesAsad Kamal
Same write-OOB and read-OOB as the Tonga fix, across seven Vega10 sub-table parsers: get_vddc_lookup_table(), get_mm_clock_voltage_table(), get_socclk/mclk/gfxclk/pixclk/dcefclk_voltage_dependency_table(). The GFXCLK table selects the correct record size per revision. Fixes: f83a9991648b ("drm/amd/powerplay: add Vega10 powerplay support (v5)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/pm/powerplay: clamp Tonga/Polaris PP sub-table ucNumEntriesAsad Kamal
ucNumEntries in the Tonga/Polaris PowerPlay sub-tables is used as both the kzalloc count and loop bound without validation, allowing a crafted VBIOS to overflow the destination heap object and read past the VBIOS image. Clamp via pp_entries_max() in get_vddc_lookup_table(), get_mclk_voltage_dependency_table(), get_sclk_voltage_dependency_table() and get_mm_clock_voltage_table(). Fixes: c82baa281843 ("drm/amd/powerplay: add Tonga dpm support (v3)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu/pm: add pp_entries_max() helperAsad Kamal
Add a static inline that returns the maximum safe record count for a PowerPlay sub-table, bounded by the lesser of soft_pp_table_size and adev->bios_size. Uses adev->bios directly to avoid a dependency on struct atom_context. Subsequent patches use it to clamp ucNumEntries. Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB readAsad Kamal
Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read when the VBIOS supplies a malformed VoltageObjectInfo table. Fixes: c82baa281843 ("drm/amd/powerplay: add Tonga dpm support (v3)") Fixes: 0d2c7569e196 ("drm/amdgpu: add new atomfirmware based helpers for powerplay") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Yang Wang <kevinyang.wang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO sizeYongqiang Sun
CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the HW field is larger than the queue's control stack allocation, memcpy reads past the BO into adjacent GTT memory and can leak kernel data to userspace. Store the page-aligned control stack BO size in mqd_manager and clamp checkpoint copies and reported checkpoint sizes to min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound for multi-XCC v9.4.3 checkpoint layout. Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com> Reviewed-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-19 22:40:44 +0000