linux-stable.git/drivers/gpu/drm/msm/msm_gpu.c, branch linux-rolling-lts

drm/msm: always recover the gpu

2026-05-17T15:15:32+00:00

commit 01a0d6cd7032e9993feea19fadb03ef9d5b488f2 upstream.

Previously, in case there was no more work to do, recover worker
wouldn't trigger recovery and would instead rely on the gpu going to
sleep and then resuming when more work is submitted.

Recover_worker will first increment the fence of the hung ring so, if
there's only one job submitted to a ring and that causes an hang, it
will early out.

There's no guarantee that the gpu will suspend and resume before more
work is submitted and if the gpu is in a hung state it will stay in that
state and probably trigger a timeout again.

Just stop checking and always recover the gpu.

Signed-off-by: Anna Maniscalco 
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.freedesktop.org/patch/704066/
Message-ID: <20260210-recovery_suspend_fix-v1-1-00ed9013da04@gmail.com>
Signed-off-by: Rob Clark 
Signed-off-by: Greg Kroah-Hartman

drm/msm: fix missing NULL check after kcalloc in crashstate_get_bos()

2025-12-18T13:03:03+00:00

[ Upstream commit 3065e6a4d3594b42dae6176b3e2c0c3563cf94b8 ]

The crashstate_get_bos() function allocates memory for `state->bos`
using kcalloc(), but the vmbind path does not check for allocation
failure before dereferencing it in the following drm_gpuvm_for_each_va()
loop. This could lead to a NULL pointer dereference if memory allocation
fails.

Fix this by wrapping the drm_gpuvm_for_each_va() loop with a NULL check
on state->bos, similar to the safety check in the non-vmbind path.

Fixes: af9aa6f316b3d ("drm/msm: Crashdump support for sparse")
Signed-off-by: Huiwen He 
Patchwork: https://patchwork.freedesktop.org/patch/687556/
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin

drm/msm: Fix NULL pointer dereference in crashstate_get_vm_logs()

2025-12-18T13:03:03+00:00

[ Upstream commit 3099e0247e3217e1b39c1c61766e06ec3d13835f ]

crashstate_get_vm_logs() did not check the return value of
kmalloc_array(). In low-memory situations, kmalloc_array() may return
NULL, leading to a NULL pointer dereference when the function later
accesses state->vm_logs.

Fix this by checking the return value of kmalloc_array() and setting
state->nr_vm_logs to 0 if allocation fails.

Fixes: 9edc52967cc7 ("drm/msm: Add VM logging for VM_BIND updates")
Signed-off-by: Huiwen He 
Patchwork: https://patchwork.freedesktop.org/patch/687555/
Signed-off-by: Rob Clark 
Signed-off-by: Sasha Levin

drm/msm: remove extraneous semicolon after a statement

2025-08-28T22:51:46+00:00

There is a statement that has an extraneous semicolon; remove it.

Signed-off-by: Colin Ian King 
Reviewed-by: Dmitry Baryshkov 
Patchwork: https://patchwork.freedesktop.org/patch/664675/
Link: https://lore.kernel.org/r/20250718133404.2047673-1-colin.i.king@gmail.com
Signed-off-by: Dmitry Baryshkov

drm/msm: skip re-emitting IBs for unusable VMs

2025-08-18T14:51:10+00:00

When a VM is marked as an usuable we disallow new submissions from it,
however submissions that where already scheduled on the ring would still
be re-sent.

Since this can lead to further hangs, avoid emitting the actual IBs.

Fixes: 6a4d287a1ae6 ("drm/msm: Mark VM as unusable on GPU hangs")
Signed-off-by: Antonino Maniscalco 
Reviewed-by: Akhil P Oommen 
Patchwork: https://patchwork.freedesktop.org/patch/668314/
Signed-off-by: Rob Clark

drm/msm: Update global fault counter when faulty process has already ended

2025-08-01T17:51:57+00:00

The global fault counter is no longer used since commit 12578c075f89
("drm/msm/gpu: Skip retired submits in recover worker"). However, it's
still needed, as we need to handle cases where a GPU fault occurs after
the faulting process has already ended.

Hence, increment the global fault counter when the submitting process
had already ended. This way, the number of faults returned by
MSM_PARAM_FAULTS will stay consistent.

While here, s/unusuable/unusable.

Fixes: 12578c075f89 ("drm/msm/gpu: Skip retired submits in recover worker")
Signed-off-by: Maíra Canal 
Patchwork: https://patchwork.freedesktop.org/patch/664853/
Signed-off-by: Rob Clark

drm/msm: Add VM logging for VM_BIND updates

2025-07-05T00:48:38+00:00

When userspace opts in to VM_BIND, the submit no longer holds references
keeping the VMA alive.  This makes it difficult to distinguish between
UMD/KMD/app bugs.  So add a debug option for logging the most recent VM
updates and capturing these in GPU devcoredumps.

The submitqueue id is also captured, a value of zero means the operation
did not go via a submitqueue (ie. comes from msm_gem_vm_close() tearing
down the remaining mappings when the device file is closed.

Signed-off-by: Rob Clark 
Signed-off-by: Rob Clark 
Tested-by: Antonino Maniscalco 
Reviewed-by: Antonino Maniscalco 
Patchwork: https://patchwork.freedesktop.org/patch/661518/

drm/msm: Crashdump support for sparse

2025-07-05T00:48:37+00:00

In this case, we need to iterate the VMAs looking for ones with
MSM_VMA_DUMP flag.

Signed-off-by: Rob Clark 
Signed-off-by: Rob Clark 
Tested-by: Antonino Maniscalco 
Reviewed-by: Antonino Maniscalco 
Patchwork: https://patchwork.freedesktop.org/patch/661504/

drm/msm: Crashdump prep for sparse mappings

2025-07-05T00:48:36+00:00

In this case, userspace could request dumping partial GEM obj mappings.
Also drop use of should_dump() helper, which really only makes sense in
the old submit->bos[] table world.

Signed-off-by: Rob Clark 
Signed-off-by: Rob Clark 
Tested-by: Antonino Maniscalco 
Reviewed-by: Antonino Maniscalco 
Patchwork: https://patchwork.freedesktop.org/patch/661496/

drm/msm: Mark VM as unusable on GPU hangs

2025-07-05T00:48:36+00:00

If userspace has opted-in to VM_BIND, then GPU hangs and VM_BIND errors
will mark the VM as unusable.

Signed-off-by: Rob Clark 
Signed-off-by: Rob Clark 
Tested-by: Antonino Maniscalco 
Reviewed-by: Antonino Maniscalco 
Patchwork: https://patchwork.freedesktop.org/patch/661499/