summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-05-28drm/panthor: Implement evicted status for GEM objectsNicolas Frattaroli
For fdinfo to be able to fill its evicted counter with data, panthor needs to keep track of whether a GEM object has ever been reclaimed. Just checking whether the pages are resident isn't enough, as newly allocated objects also won't be resident. Do this with a new atomic_t member on panthor_gem_object. It's increased when an object gets evicted by the shrinker, and saturates at INT_MAX. This means that once an object has been evicted at least once, its reclaim counter will never return to 0. Due to this, it's possible to distinguish evicted non-resident pages from newly allocated non-resident pages by checking whether reclaimed_count is != 0 Also add a new column and status flag to the panthor gems debugfs: the column is the number of times an object has been evicted, whereas the flag indicates whether it currently is evicted. Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Link: https://patch.msgid.link/20260521-panthor-bo-reclaim-observability-v5-1-49313994da55@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2026-05-28drm/i915/dp: Account for AS_SDP guardband only when enabledAnkit Nautiyal
Currently the intel_dp_sdp_min_guardband() accounts for AS_SDP for all platforms that support adaptive sync SDP even for configurations where it cannot be enabled. Instead account for adaptive sync SDP guardband only when it is enabled. Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-13-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/dp: Enable AS SDP whenever VRR is possible or PR !asyncAnkit Nautiyal
Currently AS SDP is only configured when VRR is enabled. With optimized guardband, we also need to account for wakeup time and other relevant details that depend on the AS SDP position whenever AS SDP is enabled. If a feature enabling AS SDP gets turned on later (after modeset), the guardband might not be sufficient and may need to increase, triggering a full modeset. Additionally, for Panel Replay with Aux-less ALPM where the sink does not support asynchronous video timing in PR active, the source must keep transmitting Adaptive-Sync SDPs while PR is active. So, always send AS SDP whenever there is a possibility to use it for VRR OR for Panel Replay for synchronization. v2: Check if AS SDP can be used for synchronization for VRR or PR. (Ville) v3: Use intel_psr_needs_alpm_aux_less() instead of intel_alpm_is_alpm_aux_less() to avoid including the LOBF case. (Ville) Modify the commit message and subject. Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-12-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/dp: Compute AS SDP after PSR compute configAnkit Nautiyal
A subsequent change makes intel_dp_needs_as_sdp() depend on crtc_state->has_panel_replay, which is set by intel_psr_compute_config(). Move call for intel_dp_compute_as_sdp() after the intel_psr_compute_config(). Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-11-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/dp: Compute and include coasting vtotal for AS SDPAnkit Nautiyal
DP v2.1 allows the source to temporarily suspend Adaptive-Sync SDP transmission while Panel Replay is active when the sink supports asynchronous video timing. In such cases, the sink relies on the last transmitted AS SDP timing information to maintain the refresh rate. To support this behavior, compute and populate the coasting vtotal field in the AS SDP payload. Include coasting vtotal in AS SDP packing, unpacking, and comparison, and set it during late AS SDP configuration for PR with Aux-less ALPM when asynchronous video timing is supported. Note: The coasting vtotal value is fully under driver control i.e. the HW does not overwrite these payload bytes. HW only samples the PR_ALPM_CTL[AS SDP Transmission in Active Disable] bit during PR active state and reflects it in the AS SDP payload at the appropriate time. Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-10-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/dp: Program AS SDP DB[1:0] for PR with Link offAnkit Nautiyal
For Panel Replay with AUX-less ALPM (link-off PR), the source must send Adaptive-Sync SDP v2. Program DB[1:0] per DP spec v2.1: - VRR AVT: 00b (variable VTotal) - VRR FAVT: 10b/11b (TRR not reached/reached) - Fixed timing with PR link-off (VRR off): 01b (AS disabled; VTotal fixed) Also, drop the redundant target_rr assignment. v2: Fix the else case. (Ville) Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-9-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/dp: Set relevant Downspread Ctrl DPCD bits for PR + Auxless ALPMAnkit Nautiyal
If a Panel Replay capable sink, supports Async Video timing in PR active state, then source does not necessarily need to send AS SDPs during PR active. However, if asynchronous video timing is not supported, then for PR with Aux-less ALPM, the source must transmit Adaptive-Sync SDPs for video timing synchronization while PR is active. If the source needs to send AS SDP during PR active, this requires setting DPCD 0x0107[6] (FIXED_VTOTAL_AS_SDP_EN_IN_PR_ACTIVE). This applies whether VRR is enabled (AVT/FAVT) or fixed-timing mode is used. This bit defines AS SDP timing behavior during PR Active, even if AS SDPs are briefly suspended. Program the relevant Downspread Ctrl DPCD bits accordingly. v2: Instead of Panel Replay check simply use AS SDP enable check. (Ville) v3: Since the bit is defined in context of Panel Replay and AS SDP, add a check for both. (Ville) v4: Extract pr_with_as_sdp logic into helper function. (Ville) Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-8-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/psr: Program Panel Replay CONFIG3 using AS SDP transmission timeAnkit Nautiyal
Panel Replay requires the AS SDP transmission time to be written into PANEL_REPLAY_CONFIG3. This field was previously not programmed. Use the AS SDP transmission-time helper to populate CONFIG3. Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-7-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/display: Add helper for AS SDP transmission time selectionAnkit Nautiyal
AS SDP may be transmitted at T1 or T2 depending on Panel Replay and Adaptive Sync SDP configuration as per DP 2.1. Current we are using T1 only, but future PR/AS SDP modes/features may require T2 or dynamic selection. Introduce a helper to return the appropriate AS SDP transmission time so that a single value is consistently used for programming PR_ALPM. For now this returns T1. v2: Avoid adding new member to crtc_state; use a helper. (Ville) v3: Clarify why AS SDP transmission time is fixed to T1. (Ville) v4: Return u8 from intel_dp_as_sdp_transmission_time(). (Ville) Bspec: 68920 Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-6-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/psr: Write the PR config DPCDs in burst modeAnkit Nautiyal
Replace the consecutive single-byte writes to PANEL_REPLAY_CONFIG and CONFIG2 with one drm_dp_dpcd_write() burst starting at PANEL_REPLAY_CONFIG, reducing AUX transactions. v2: Drop extra conditions, and optimize variables. (Ville) v3: Drop the error check after write. (Ville) Suggested-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-5-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/dp: Allow AS SDP only if v2 is supportedAnkit Nautiyal
We do not support AS SDP version 1, so allow AS SDP only if AS SDP v2 is supported. Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-4-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/dp: Add member to intel_dp to store AS SDP v2 supportAnkit Nautiyal
eDP v1.5a advertises support for Adaptive Sync SDP and with that the support for AS SDP v2 is mandatory. DP v2.1 SCR advertises support for FAVT payload fields parsing in DPCD 0x2214 Bit 2. This indicates the support for Adaptive-Sync SDP version 2 (AS SDP v2), which allows the source to set the version in HB2[4:0] and the payload length in HB3[5:0] of the AS SDP header. DP v2.1 SCR also introduces ASYNC_VIDEO_TIMING_NOT_SUPPORTED_IN_PR in the Panel Replay Capability DPCD 0x00b1 (Bit 3). When this bit is set, the sink does not support asynchronous video timing while in a Panel Replay Active state and the source is required to keep transmitting Adaptive-Sync SDPs. The spec mandates that such sinks shall support AS SDP v2. Infer AS SDP v2 support from these capabilities and store it in struct intel_dp for use by subsequent feature enablement changes. v2: - Include parsing ASYNC_VIDEO_TIMING_NOT_SUPPORTED_IN_PR bit to determine AS SDP v2 support. (Ville) v3: - Use helper to determine asynch video timing support. v4: - Add AS SDP v2 support for eDP as per v1.5a. - Add a check for Panel Replay support before checking for Async video timing support in PR - Add a TODO for Display ID and PCON considerations. (Ville) Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-3-ankit.k.nautiyal@intel.com
2026-05-28drm/i915/psr: Add helper to get Async Video timing support in PR activeAnkit Nautiyal
Introduce a helper to check if Panel Replay has Async Video Timing support during PR Active state. v2: Confirm that Panel Replay is supported before checking for Async Video Timing Support during PR active. (Ville) Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260527041050.601735-2-ankit.k.nautiyal@intel.com
2026-05-28Merge drm/drm-next into drm-misc-nextThomas Zimmermann
Backmerging to get GEM LRU fixes from commit 379e8f1c ("drm/gem: Make the GEM LRU lock part of drm_device") and other updates from v7.1-rc5. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2026-05-28Merge v7.1-rc5 into drm-nextSimona Vetter
Boris Brezillion needs the gem lru fixes 379e8f1ca5e9 ("drm/gem: Make the GEM LRU lock part of drm_device") backmerged for drm-misc-next. That also means we need to sort out the rename conflict in panthor with the fixup patch from Boris from drm-tip. Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
2026-05-28drm/i915: rename intel_runtime_{suspend, resume} to ↵Jani Nikula
i915_pm_runtime_{suspend, resume} All the other struct dev_pm_ops hooks are named i915_pm_*(), but the .runtime_suspend and .runtime_resume hooks are called intel_runtime_suspend() and intel_runtime_resume(), respectively. Rename intel_runtime_suspend() to i915_pm_runtime_suspend() and intel_runtime_resume() to i915_pm_runtime_resume() to unify. Cc: Imre Deak <imre.deak@intel.com> Reviewed-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/fc5b796a3fd764a64b257edfdbe08e54b690efbc.1779876087.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-28drm/i915/power: add "runtime" to intel_display_power_{suspend, resume}() namesJani Nikula
The intel_display_power_suspend() and intel_display_power_resume() functions are supposed to be called from the struct dev_pm_pops .runtime_suspend and .runtime_resume hook paths. Name them accordingly to intel_display_power_runtime_suspend() and intel_display_power_runtime_resume(). Cc: Imre Deak <imre.deak@intel.com> Reviewed-by: Imre Deak <imre.deak@intel.coM> Link: https://patch.msgid.link/4a8ae520e3151d6cf5d9e9e3a452f620cf781ee5.1779876087.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-28drm/exynos: fix size_t format stringArnd Bergmann
The exynos_gem->base.size argument is a size_t rather than an unsigned long, so adapt the printk() format string accordingly: In file included from drivers/gpu/drm/exynos/exynos_drm_gem.c:16: drivers/gpu/drm/exynos/exynos_drm_gem.c: In function 'exynos_drm_alloc_buf': drivers/gpu/drm/exynos/exynos_drm_gem.c:69:49: error: format '%lx' expects argument of type 'long unsigned int', but argument 6 has type 'size_t' {aka 'unsigned int'} [-Werror=format=] 69 | DRM_DEV_DEBUG_KMS(drm_dev_dma_dev(dev), "dma_addr(0x%lx), size(0x%lx)\n", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 70 | (unsigned long)exynos_gem->dma_addr, exynos_gem->base.size); | ~~~~~~~~~~~~~~~~~~~~~ | | | size_t {aka unsigned int} The dma_addr in the same line is already printed using a cast to unsigned long, so change that similarly to use the correct %pad format. Fixes: 11e898373fba ("drm/exynos: Drop exynos_drm_gem.size field") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch> Link: https://patch.msgid.link/20260527194525.45762-1-arnd@kernel.org
2026-05-28drm/i915/bw: Do not consider tile4 as tileYVille Syrjälä
For the purposes of memory bandwidth calculations tile4 should not be considered the same as tileY. Make it so. This should not actually change anything as the affected code only applies to pre-MTL integrated GPUs, which don't have tile4. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260522200346.17377-11-ville.syrjala@linux.intel.com Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
2026-05-28drm/i915/bw: Remove deinterleave fallback for TGL+Ville Syrjälä
Remove the deinterleave fallback calculation from the TGL+ codepath. The fallback is using the ICL deinterleave calculation which was never in the TGL+ algorithm. All supported memory types have the correct deinterleave already specified for TGL+ anyway, so this is dead code. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260522200346.17377-10-ville.syrjala@linux.intel.com Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
2026-05-28drm/i915/bw: Round the PM demand bandwidth downVille Syrjälä
Bspec asks us to round down instead of closest doing the /100 for the PM demand bandwidth. Make it so. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260522200346.17377-9-ville.syrjala@linux.intel.com Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
2026-05-28drm/i915/bw: Fix/unify peakbw calculationsVille Syrjälä
We have several copies of the same memory peak bandwidth calculations, and the rounding directions are all over the place in some of them. Unify it all into one small function (with rounding matching what Bspec says). Note that 'channel_width' is always a multiple of 8 anyway, so for 'channel_width / 8' the rounding direction doesn't actually matter. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260522200346.17377-8-ville.syrjala@linux.intel.com Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
2026-05-28drm/i915/bw: Fix DEPROGBWPCLIMIT handling on BMGVille Syrjälä
DEPROGBWPCLIMIT is specified in %, so divide by 100 instead of 10. Fortunately the deprobbwlimit is much lower than the peak memory bandwidth on BMG, so whether we take 60% or 600% of the peak bandwidth doesn't matter as the min() will pick the lower deprobbwlimit anyway. Eg. on the BMG here I get (with or without the fix): QGV 0: deratedbw=33600 peakbw=48000 QGV 1: deratedbw=53000 peakbw=456000 Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260522200346.17377-7-ville.syrjala@linux.intel.com Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
2026-05-28drm/i915/bw: Fix rounding direction in clperchgroup calculationVille Syrjälä
The '8/num_channels' in the clperchgroup is supposed to be rounded down according to the spec. Make it so. Not sure we can ever actually have a non-power of two number of channels, so this might not matter. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260522200346.17377-6-ville.syrjala@linux.intel.com Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
2026-05-28drm/i915/bw: Fix 'deinterleave' rounding directionVille Syrjälä
For some reason we're rounding up when calculating the deinterleave value. But the spec says we should round down. Fix it. But I suppose this doesn't actually matter since the deinterleave values should always be power of two. The only exception is therefore the deinterleave==1 case, which gets handled by the max(..., 1). Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260522200346.17377-5-ville.syrjala@linux.intel.com Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
2026-05-28drm/i915/bw: Fix bw rounding directionVille Syrjälä
The DRAM bandwidth value should be rounded down, not up. Bspec: 64631 Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260522200346.17377-4-ville.syrjala@linux.intel.com Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
2026-05-28drm/i915/bw: Fix DCLK rounding messVille Syrjälä
Fix up the total mess when calculating the DCLK frequency. Some codepaths are trying to do both DIV_ROUND_UP() and an open coded "round to nearest" at the same time. The MTL+ codepath was the only one that was correct (using DIV_ROUND_CLOSEST()). Let's unify all of them, and borrow the actual '100/6' approach from adl_calc_psf_bw() so that we get even less rounding errors. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260522200346.17377-3-ville.syrjala@linux.intel.com Reviewed-by: Vinod Govindapillai <vinod.govindapillai@intel.com>
2026-05-28drm/i915/bw: Fix num_planes handling on TGL+Ville Syrjälä
The TGL+ bw code has an off by one error on the num_planes calculation, and tgl_max_bw_index() incorrectly bumps the num_planes to 1 from 0. That approach made sense on ICL where num_planes is more or less a minimum number of planes to consider for the group, but on TGL+ num_planes really is a maximum number of planes, so these adjustments no longer make any sense there. Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260522200346.17377-2-ville.syrjala@linux.intel.com Reviewed-by: Michał Grzelak <michal.grzelak@intel.com>
2026-05-27drm/xe: Move xe_uc_fw_abi.h to abi/Michal Wajdeczko
We aim to keep all pure ABI headers in the abi/ folder, but somehow we missed this file. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260527112608.22448-1-michal.wajdeczko@intel.com
2026-05-27drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfxChristian König
Otherwise we don't invalidate page tables on next CS. Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Tested-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b6444d1bcbc34f6f2a31a3aab3059be082f3683e) Cc: stable@vger.kernel.org
2026-05-27drm/amdgpu: fix amdgpu_hmm_range_get_pagesChristian König
The notifier sequence must only be read once or otherwise we could work with invalid pages. While at it also fix the coding style, e.g. drop the pre-initialized return value and use the common define for 2G range. Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Tested-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit c08972f555945cda57b0adb72272a37910153390) Cc: stable@vger.kernel.org
2026-05-27drm/amdgpu/userq: use array instead of list for userq_vasSunil Khatri
Use arrays instead of list for userq_vas since we have fixed no of bos. Also, we dont have to worry to free that memory later since this array would be free along with queue only. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ef7dc711a664b0c548ecfdf13a00436b7446b8e7)
2026-05-27drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj validSunil Khatri
mqd_destroy cleans up queue core objects like mqd and fw_object which are needed for any pending fence to signal properly. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 4ad65d610096498c8e265615aba42b3c47441bb5)
2026-05-27drm/amdkfd: fix a vulnerability of integer overflow in kfd debuggerEric Huang
get_queue_ids() computes array_size = num_queues * sizeof(uint32_t), which could overflow on 32-bit size_t build. using array_size() instead, it saturates to SIZE_MAX on overflow. Signed-off-by: Eric Huang <jinhuieric.huang@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 2d57a0475f085c08b49312dfd8edcb461845f285) Cc: stable@vger.kernel.org
2026-05-27drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapperSunil Khatri
Remove the amdgpu_userq_create/destroy_object wrappers and use directly the kernel bo allocation function which does all the things which are done in wrapper. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Suggested-by: Christian König <christian.koenig@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit deb02080ca5d3f015cf71e56067a39ef2f141998)
2026-05-27drm/amd/pm/si: Disregard vblank time when no displays are connectedTimur Kristóf
When no displays are connected, there is no vblank happening so the power management code shouldn't worry about it. This fixes a regression that caused the memory clock to be stuck at maximum when there were no displays connected to a SI GPU. Fixes: 9003a0746864 ("drm/amd/pm: Treat zero vblank time as too short in si_dpm (v3)") Fixes: 9d73b107a61b ("drm/amd/pm: Use pm_display_cfg in legacy DPM (v2)") Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Tested-by: Jeremy Klarenbeek <jeremy.klarenbeek99@gmail.com> Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 6d87e0199f7b83735b56e422d59f170a201897a8) Cc: stable@vger.kernel.org
2026-05-27drm/amdkfd: Check for pdd drm file first in CRIU restore pathDavid Francis
CRIU restore ioctls are meant to be called by CRIU with no existing drm file. There's an error path for if the drm file unexpectedly exists. It was positioned so it was missing a fput(drm_file). Do that check earlier, as soon as we have the pdd. Signed-off-by: David Francis <David.Francis@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 2bab781dac78916c5cc8de76345a4102449267d7) Cc: stable@vger.kernel.org
2026-05-27drm/amdgpu: fix potential overflow in fs_info.debugfs_nameStanley.Yang
Use snprintf() with sizeof(fs_info.debugfs_name) so a long RAS block name plus the "_err_inject" suffix cannot overflow the 32-byte buffer. Signed-off-by: Stanley.Yang <Stanley.Yang@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1a58070fda26857a8f6acc0ab05428e60d5c6844)
2026-05-27drm/amdgpu/userq: make sure queue is valid in the hang_detect_workSunil Khatri
Thread 1: Running amdgpu_userq_destroy which eventually remove the queue from door bell and set userq_mgr = NULL. Thread2: An interrupt might have scheduled the hang_detect_work which still need userq_mgr to be valid but could get an NULL ptrs. To fix that make sure we cancel the hang_detect_work again before setting userq_mgr to NULL. Along with that we also need all the queue va to remain valid till we could be running anything on the queue and hence moving the userq_va post hang_detect handler is cancelled. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1a66ceb98b137d18d303b9889f0e7d8c4db73943)
2026-05-27drm/amdgpu/userq: reserve root bo without interruptionSunil Khatri
Fix the code to make it an uninterruptible reservation for root bo. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d409ab4e387d94b2e593d558b54b7bfd315e0e75)
2026-05-27drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart failsSunil Khatri
Unpin the wptr_obj->obj when amdgpu_ttm_alloc_gart fails. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d8145c437ccdc2d91c579787290f82788172bea0)
2026-05-27drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_indexSunil Khatri
amdgpu_userq_get_doorbell_index returns a uint64 type index as well as a int type failure values. Simplifying this and using a int type return value and getting the index in input pointer of type uint64 type. Also since it's used at once place making it static would be better. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit e947ec9d0529d5f93dbdb33cd197347f6a7b2922)
2026-05-27drm/amdkfd: fix NULL pointer bug in svm_range_set_attrEric Huang
The process_info could be NULL if user doesn't call kfd_ioctl_acquire_vm before calling kfd_ioctl_svm. Signed-off-by: Eric Huang <jinhuieric.huang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 83a26c812e0529eb040d31a76f73e33e637243d4) Cc: stable@vger.kernel.org
2026-05-27drm/amd/display: Write REFCLK to 48MHz on DCN21Ivan Lipski
[Why&How] dccg21_init() calls dccg2_init() which hardcodes 100MHz refclk values for MICROSECOND_TIME_BASE_DIV and MILLISECOND_TIME_BASE_DIV. DCN21 uses 48MHz refclk, so the wrong values corrupt DCCG timing and cause eDP link training failure on cold boot. Write the correct 48MHz values directly instead of calling dccg2_init(). v2: Fixed typo Fixes: e6e2b956fc81 ("drm/amd/display: Add missing DCCG register entries for DCN20-DCN316") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5272 Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5311 Reported-by: Max Chernoff <git@maxchernoff.ca> Tested-by: Max Chernoff <git@maxchernoff.ca> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 08236c3ef284cd2d110e5e3d51fc9615e551f9dc) Cc: stable@vger.kernel.org
2026-05-27drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lockSunil Khatri
mutex fence_drv_lock is destroyed in amdgpu_userq_fence_driver_free also in one of the jump condition mutex_destroy is also called leading to double mutex_destroy. So rearranging the code so amdgpu_userq_fence_driver_free takes care of the clean up along with mutex_destroy. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 384dbef269d101e5b671fc7b942c56734cd1d186)
2026-05-27drm/amdgpu/userq: Fix doorbell object cleanup of queueSunil Khatri
Unpin and unref the door bell obj if queue creation fails before initialization is complete. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 8c7506f7ba945f21e5abe7f8eac0a3acca6b5330)
2026-05-27drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFOZiyi Guo
kvcalloc(args->num_entries, sizeof(*vm_entries), GFP_KERNEL) at amdgpu_gem.c:1050 uses the user-supplied num_entries directly without any upper bounds check. Since num_entries is a __u32 and sizeof(drm_amdgpu_gem_vm_entry) is 32 bytes, a large num_entries produces an allocation exceeding INT_MAX, triggering WARNING in __kvmalloc_node_noprof(), causing a kernel WARNING, TAINT_WARN, and panic on CONFIG_PANIC_ON_WARN=y systems. Add a size bounds check before we invoke the kvzalloc() to reject oversized num_entries early with -EINVAL. Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP ioctl") Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d) Cc: stable@vger.kernel.org
2026-05-27drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFOMichael Bommarito
The AMDGPU_GEM_OP_GET_MAPPING_INFO branch of amdgpu_gem_op_ioctl() holds three cleanup-tracked resources before calling kvcalloc(): the drm_gem_object reference from drm_gem_object_lookup(), the drm_exec lock on the looked-up GEM via drm_exec_lock_obj(), and the drm_exec lock on the per-process VM root page directory via amdgpu_vm_lock_pd(). All three are released by the out_exec label that every other error path in this function jumps to. The kvcalloc() failure path returns -ENOMEM directly, skipping out_exec and leaking all three. The leaked per-process VM root PD dma_resv lock is the load-bearing leak: any subsequent operation on the same VM (further GEM ops, command-submission, eviction, TTM shrinker callbacks) blocks on the held lock. DRM_IOCTL_AMDGPU_GEM_OP is DRM_AUTH | DRM_RENDER_ALLOW, so this is an unprivileged-local denial of service against the caller's GPU context, reachable by any process with /dev/dri/renderD* access. Route the failure through out_exec so drm_exec_fini() and drm_gem_object_put() run. Reproduced on stock 7.0.0-10, Ryzen 7 5700U / Radeon Vega (Lucienne): the failing ioctl returns -ENOMEM and a second GET_MAPPING_INFO on the same fd then blocks in drm_exec_lock_obj() on the leaked dma_resv. SIGKILL on the caller does not reap the task; the fd-release path during process exit goes through amdgpu_gem_object_close() -> drm_exec_prepare_obj() on the same lock, leaving the task in D state until the box is rebooted. The patched kernel was not rebuilt and re-tested on this hardware; the fix is mechanical. Tested on a single Lucienne / Vega box only. Ziyi Guo posted an independent INT_MAX-bound check for args->num_entries in the same branch [1]; the two patches are complementary and can land in either order. Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP ioctl") Link: https://lore.kernel.org/all/20260208000255.4073363-1-n7l8m4@u.northwestern.edu/ # [1] Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b69d3256d79de15f54c322986ff4da68f1d65b0a) Cc: stable@vger.kernel.org
2026-05-27drm/xe: Restore IDLEDLY regiter on engine resetBalasubramani Vivekanandan
Wa_16023105232 programs the register IDLEDLY. The register is reset whenever the engine is reset. Therefore it should be added to the GuC save-restore register list for it to be restored after reset. Fixes: 7c53ff050ba8 ("drm/xe: Apply Wa_16023105232") Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260522163531.1365540-2-balasubramani.vivekanandan@intel.com Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com> (cherry picked from commit df1cfe24743a93b71eab27687e148ab8ae9b69e3) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-05-27drm/radeon/radeon_connectors: remove radeon_connector_free_edidJoshua Peisach
Since we are using struct drm_edid, we can call drm_edid_free directly. Also make sure to set the pointer to NULL afterwards. Signed-off-by: Joshua Peisach <jpeisach@ubuntu.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>