linux-stable.git/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c, branch v7.2 Linux kernel stable tree drm/amd/display: add HDMI 2.1 Compliance Support 2026-06-03T17:44:56+00:00 Fangzhi Zuo Jerry.Zuo@amd.com 2026-04-28T20:53:29+00:00 7e5760f084d06ca57e46e4dbf7ef08f03f857be8 Add force yuv format from igt for compliance test. Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
Add force yuv format from igt for compliance test.

Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs 2026-06-03T17:34:38+00:00 Harry Wentland harry.wentland@amd.com 2026-05-11T20:46:25+00:00 6ab4c36a522842ff70474a1c0af2e40e50fc8300 [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why & How]
dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc
without checking for NULL. A connector can be connected but not bound to
any CRTC (e.g. after hot-plug before the next atomic commit), causing a
kernel crash when writing to the sdp_message debugfs node.

The function also ignores the user-provided size argument and always
passes 36 bytes to copy_from_user(), reading past the user buffer when
size < 36.

Fix both issues by:
- Returning -ENODEV when connector->base.state or state->crtc is NULL
- Clamping write_size to min(size, sizeof(data))

Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu")
Assisted-by: Copilot:claude-opus-4.6
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Add additional IPS entry/exit for PSR/Replay 2026-05-11T20:10:55+00:00 Ivan Lipski ivan.lipski@amd.com 2026-04-29T23:05:20+00:00 17d0aeff8b72289e5e438ba1a2bb542cc780dddc [Why] Multiple paths issue DMUB commands without managing IPS state, causing dc_wake_and_execute_gpint/dmub_cmd to internally wake from IPS and reallow idle. This flips idle_allowed back to true while idle_optimizations_allowed remains false during in-flight commits, desynchronizing the two flags. Affected paths: - amdgpu_dm_psr_set_event() and amdgpu_dm_replay_set_event() calls from amdgpu_dm_handle_vrr_transition(), amdgpu_dm_commit_planes() and amdgpu_dm_mod_power_update_streams(), that are invoked on atomic commits. - debugfs psr_get(), psr_read_residency(), replay_get_state(), replay_set_residency() access hardware without holding dc_lock or disabling IPS. [How] - Explicitly exit IPS before PSR/Replay set_event w/ hw_programming, called within atomic commit. - Wrap debugfs PSR/Replay state getters and setters with IPS exit/entry + dc_lock. Reviewed-by: Sunpeng Li <sunpeng.li@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: James Lin <pinglei.lin@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why]
Multiple paths issue DMUB commands without managing IPS state, causing
dc_wake_and_execute_gpint/dmub_cmd to internally wake from IPS and
reallow idle. This flips idle_allowed back to true while
idle_optimizations_allowed remains false during in-flight commits,
desynchronizing the two flags.

Affected paths:

- amdgpu_dm_psr_set_event() and amdgpu_dm_replay_set_event() calls from
  amdgpu_dm_handle_vrr_transition(), amdgpu_dm_commit_planes() and
  amdgpu_dm_mod_power_update_streams(), that are invoked on atomic commits.
- debugfs psr_get(), psr_read_residency(), replay_get_state(),
  replay_set_residency() access hardware without holding dc_lock or
  disabling IPS.

[How]
- Explicitly exit IPS before PSR/Replay set_event w/ hw_programming,
  called within atomic commit.
- Wrap debugfs PSR/Replay state getters and setters with IPS exit/entry +
  dc_lock.

Reviewed-by: Sunpeng Li <sunpeng.li@amd.com>
Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
Signed-off-by: James Lin <pinglei.lin@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Add power module on Linux 2026-04-17T19:41:16+00:00 Ray Wu ray.wu@amd.com 2025-12-30T01:56:28+00:00 3c108046e1d6fa550ccdd8fc3396fc5e561f2de2 [Why & How] Refactors dm to utilize the power module for managing replay, PSR, and backlight control functionalities. Key changes: - Introduced replay / PSR events to enable / disable replay / PSR. - Implemented replay rate control and power option - Refactored backlight control by using the power module. - Enhanced handling of VRR within replay and PSR logic. Reviewed-by: Leo Li <sunpeng.li@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Signed-off-by: Leo Li <sunpeng.li@amd.com> Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why & How]
Refactors dm to utilize the power module for managing
replay, PSR, and backlight control functionalities.

Key changes:
- Introduced replay / PSR events to enable / disable replay / PSR.
- Implemented replay rate control and power option
- Refactored backlight control by using the power module.
- Enhanced handling of VRR within replay and PSR logic.

Reviewed-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Signed-off-by: Leo Li <sunpeng.li@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Add debugfs to disallow eDP Replay entry 2026-03-17T14:35:40+00:00 Ray Wu ray.wu@amd.com 2026-03-02T02:26:51+00:00 f7168d1a8d356209f96c071e5fbff98201decaf9 [Why & How] Test applications need to read CRC from eDP sink side, but sink replay feature prevents proper CRC reading and causing timeout. Add disallow_edp_enter_replay debugfs interface to allow test apps to temporarily disable Replay for CRC operations. Reviewed-by: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Signed-off-by: Chuanyu Tseng <chuanyu.tseng@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why & How]
Test applications need to read CRC from eDP sink side, but sink
replay feature prevents proper CRC reading and causing timeout.

Add disallow_edp_enter_replay debugfs interface to allow test apps
to temporarily disable Replay for CRC operations.

Reviewed-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Signed-off-by: Chuanyu Tseng <chuanyu.tseng@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-22T01:09:51+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-02-22T00:37:42+00:00 bf4afc53b77aeaa48b5409da5c8da6bb4eff7f43 This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
This was done entirely with mindless brute force, using

    git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
        xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'

to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.

Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.

For the same reason the 'flex' versions will be done as a separate
conversion.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21T09:02:28+00:00 Kees Cook kees@kernel.org 2026-02-21T07:49:23+00:00 69050f8d6d075dc01af7a5f2f550a8067510366f This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org> 
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook <kees@kernel.org>
drm/amd/display: Add CRC 32-bit mode support for DCN3.6+ 2026-02-03T21:43:12+00:00 Chenyu Chen chen-yu.chen@amd.com 2026-01-22T09:19:07+00:00 1a77ecec8b35258c45b6963698e5dc378c67ef32 [Why] DCN 3.6+ hardware supports CRC-32 polynomial in addition to the legacy CRC-16. Enable 32-bit CRC values per color component for improvement of precision in display validation. [How] When userspace sets crc_poly_mode (0=CRC-16, 1=CRC-32) via the debugfs interface, the value is stored in dm_irq_params.crc_poly_mode. When CRC source configuration triggers amdgpu_dm_crtc_configure_crc_source(), crc_poly_mode is retrieved from dm_irq_params and passed to dc_stream_configure_crc(). In the DC layer, dc_stream_configure_crc() sets crc_poly_mode into the crc_params structure and passes it to optc35_configure_crc(). If the hardware supports the OTG_CRC_POLY_SEL register, the register is programmed to select CRC-16 or CRC-32 polynomial. When reading CRC values, optc35_get_crc() checks whether CRC32 register masks are available. If present, it reads 32-bit CRC values from OTG_CRC0/1_DATA_R32/G32/B32 registers; otherwise, it falls back to reading 16-bit CRC values from legacy OTG_CRC0/1_DATA_RG/B registers. Reviewed-by: ChiaHsuan Chung <chiahsuan.chung@amd.com> Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why]
DCN 3.6+ hardware supports CRC-32 polynomial in addition to the
legacy CRC-16. Enable 32-bit CRC values per color component for
improvement of precision in display validation.

[How]
When userspace sets crc_poly_mode (0=CRC-16, 1=CRC-32) via the debugfs
interface, the value is stored in dm_irq_params.crc_poly_mode. When CRC
source configuration triggers amdgpu_dm_crtc_configure_crc_source(),
crc_poly_mode is retrieved from dm_irq_params and passed to
dc_stream_configure_crc().

In the DC layer, dc_stream_configure_crc() sets crc_poly_mode into the
crc_params structure and passes it to optc35_configure_crc(). If the
hardware supports the OTG_CRC_POLY_SEL register, the register is
programmed to select CRC-16 or CRC-32 polynomial.

When reading CRC values, optc35_get_crc() checks whether CRC32 register
masks are available. If present, it reads 32-bit CRC values from
OTG_CRC0/1_DATA_R32/G32/B32 registers; otherwise, it falls back
to reading 16-bit CRC values from legacy OTG_CRC0/1_DATA_RG/B
registers.

Reviewed-by: ChiaHsuan Chung <chiahsuan.chung@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Signed-off-by: Wayne Lin <wayne.lin@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Fix IGT ILR link training failure on Replay panel 2026-02-03T21:40:03+00:00 Ray Wu ray.wu@amd.com 2026-01-20T08:55:43+00:00 e121ccca8a4a5dd6fb5d395de6ef31ebfce7fb38 [Why & How] Fix the IGT ilr_link-training-configs test failure by directly using the supported link rates from DPCD. Reviewed-by: ChiaHsuan Chung <chiahsuan.chung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why & How]
Fix the IGT ilr_link-training-configs test failure
by directly using the supported link rates from DPCD.

Reviewed-by: ChiaHsuan Chung <chiahsuan.chung@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Signed-off-by: Wayne Lin <wayne.lin@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Fix IGT link training failure on Replay panel 2026-02-03T21:39:53+00:00 Ray Wu ray.wu@amd.com 2026-01-20T08:29:38+00:00 bb4099c7d90043673c8089ae1dce0d6c7d393f13 [Why] IGT link-training-configs test fails to set the link rate on Replay panels because some link rate types are not supported in debugfs. As a result, debugfs treats these link rates as invalid, causing the IGT test to fail. [How] Add missing link rate types to resolve this issue. Reviewed-by: ChiaHsuan Chung <chiahsuan.chung@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> 
[Why]
IGT link-training-configs test fails to set the link rate on Replay panels
because some link rate types are not supported in debugfs. As a result,
debugfs treats these link rates as invalid, causing the IGT test to fail.

[How]
Add missing link rate types to resolve this issue.

Reviewed-by: ChiaHsuan Chung <chiahsuan.chung@amd.com>
Signed-off-by: Ray Wu <ray.wu@amd.com>
Signed-off-by: Wayne Lin <wayne.lin@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>