linux.git/drivers/gpu/drm/imagination, branch v7.2

Revert "drm/imagination: Remove drm_sched_init_args->num_rqs usage"

2026-08-11T16:34:04+00:00

This reverts commit f84d73d2a08498174d950ba5935930dd94df7d3c.

Signed-off-by: Tvrtko Ursulin 
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost 
Cc: Danilo Krummrich 
Cc: Philipp Stanner 
Cc: Christian König 
Signed-off-by: Tvrtko Ursulin 
Link: https://lore.kernel.org/r/20260811163139.99746-11-tvrtko.ursulin@igalia.com

drm/imagination: Update the trace point pvr_job_submit_fw()

2026-07-29T13:42:15+00:00

Trace point pvr_job_submit_fw() is used to trace job submission to
the FW. Currently it is recorded when a command is written to the Client
circular buffer.

Move trace recording after writing command to the Kernel circular buffer to
better represent command submission to the FW.

Fixes: c1079aebb4de ("drm/imagination: Add support for trace points")
Signed-off-by: Brajesh Gupta 
Reviewed-by: Alessio Belle 
Link: https://patch.msgid.link/20260724-b4-tracepoint-fix-v3-1-8f8e5e8179d3@imgtec.com
Signed-off-by: Alessio Belle

drm/imagination: Fix value of HWRT address in pvr_job_create tracepoint

2026-07-24T07:46:18+00:00

The pvr_job_create tracepoint was using pvr_fw_object::fw_addr_offset
to display the firmware address of the render target structure attached
to a job, but that's an offset into the firmware heap, not the expected
full address, which is more useful in general e.g. for cross referencing
against firmware logs.

Use pvr_fw_object_get_fw_addr() to get the full firmware address.

Fixes: c1079aebb4de ("drm/imagination: Add support for trace points")
Reviewed-by: Brajesh Gupta 
Link: https://patch.msgid.link/20260720-fix-pvr-job-trace-hwrt-v1-1-b24551802efb@imgtec.com
Signed-off-by: Alessio Belle

drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM

2026-07-20T14:01:14+00:00

The drm gpuvm code doesn't protect find operation against map operation,
and the driver needs to ensure a map operation shouldn't happen when a
find operation is in progress.

In some cases a find operation will be in progress when doing map/unmap
operations, and the find operation will do a NULL pointer dereference.

An example of the stack trace of such NULL dereference is shown below:

```
Unable to handle kernel access to user memory without uaccess routines at
virtual address 0000000000000010

[] drm_gpuva_find+0x28/0x6c [drm_gpuvm]
[] pvr_vm_unmap+0x34/0x68 [powervr]
[] pvr_ioctl_vm_unmap+0x2e/0x50 [powervr]
[] drm_ioctl_kernel+0x8e/0xdc
[] drm_ioctl+0x1be/0x3e0
[] __riscv_sys_ioctl+0xba/0xc4
[] do_trap_ecall_u+0x23e/0x3f4
[] handle_exception+0x168/0x174
```

As all occurences of drm_gpuva_find*() are already guarded by
vm_ctx->lock, make pvr_vm_map() to acquire this lock to prevent
disturbing any find operation. This fixes the NULL deference problem in
drm_gpuva_find*().

Cc: stable@vger.kernel.org
Fixes: ff5f643de0bf ("drm/imagination: Add GEM and VM related code")
Fixes: 4bc736f890ce ("drm/imagination: vm: make use of GPUVM's drm_exec helper")
Signed-off-by: Icenowy Zheng 
Reviewed-by: Alessio Belle 
Link: https://patch.msgid.link/20260714073641.1935075-1-zhengxingda@iscas.ac.cn
Signed-off-by: Alessio Belle

Merge tag 'drm-misc-fixes-2026-07-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

2026-07-10T03:03:15+00:00

drm-misc-fixes for v7.2-rc3:
- Fix uaf in amdxdna mmap failure path.
- A lot of deadlocks, access races and return value fixes in amdxdna.
- Fix analogix_dp bitshifts during link training.
- Use direct label in drm_exec.
- Fix absent indirect bo handling in v3d.
- Sync on first active crtc in fb_dirty, rather than first crtc.
- Rework try_harder in the buddy allocator.
- Make imagination function static to solve compiler warning.
- Fix imagination error checking.

Signed-off-by: Dave Airlie 
From: Maarten Lankhorst 
Link: https://patch.msgid.link/71e5b48b-307f-47f5-8fd5-b60ea43e4196@linux.intel.com

drm/imagination: fix error checking of pvr_vm_context_lookup()

2026-07-09T14:07:32+00:00

Since pvr_vm_context_lookup() returns either NULL or a pointer, then stop
using IS_ERR() for checking the return value.

Using IS_ERR() leads to the kernel oops reported below. It can be
reproduced by passing an invalid VM context handle from userspace to the
DRM_IOCTL_PVR_CREATE_CONTEXT ioctl.

[   92.733119] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000148
[   92.742042] Mem abort info:
[   92.744890]   ESR = 0x0000000096000004
[   92.748686]   EC = 0x25: DABT (current EL), IL = 32 bits
[   92.754020]   SET = 0, FnV = 0
[   92.757154]   EA = 0, S1PTW = 0
[   92.760337]   FSC = 0x04: level 0 translation fault
[   92.765243] Data abort info:
[   92.768129]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[   92.773626]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[   92.778763]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[   92.784098] user pgtable: 4k pages, 48-bit VAs, pgdp=000000088ed23000
[   92.790550] [0000000000000148] pgd=0000000000000000, p4d=0000000000000000
[   92.797381] Internal error: Oops: 0000000096000004 [#1]  SMP
[   92.803027] Modules linked in: powervr
[   92.852533] CPU: 0 UID: 0 PID: 409 Comm: triangle Not tainted 7.1.0-rc5-g98b46e693b91 #1 PREEMPT
[   92.861385] Hardware name: Texas Instruments AM68 SK (DT)
[   92.866766] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   92.873709] pc : pvr_vm_get_fw_mem_context+0x0/0xc [powervr]
[   92.879376] lr : pvr_queue_create+0x26c/0x440 [powervr]
[   92.884595] sp : ffff8000837fbb00
[   92.887895] x29: ffff8000837fbb60 x28: 0000000000000000 x27: ffff8000837fbce8
[   92.895015] x26: ffff000807f61a40 x25: ffff000807f61a00 x24: ffff000807f64400
[   92.902135] x23: ffff00080a5ab000 x22: ffff800079b24730 x21: ffff000807f61800
[   92.909254] x20: ffff00080999e680 x19: 0000000000000000 x18: 0000000000000000
[   92.916373] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
[   92.923492] x14: 0000000000000000 x13: 0000000000000002 x12: ffff80008145b298
[   92.930611] x11: ffff8000844e5000 x10: ffff80008165a130 x9 : 0000000000000100
[   92.937730] x8 : 0000000000000001 x7 : ffff0008076b27e0 x6 : ffff00080ec43b7c
[   92.944850] x5 : ffff00080ec43b78 x4 : 0000000000000000 x3 : ffff00080999e680
[   92.951968] x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
[   92.959088] Call trace:
[   92.961521]  pvr_vm_get_fw_mem_context+0x0/0xc [powervr] (P)
[   92.967173]  pvr_context_create+0x190/0x410 [powervr]
[   92.972218]  pvr_ioctl_create_context+0x44/0x8c [powervr]
[   92.977608]  drm_ioctl_kernel+0xbc/0x124 [drm]
[   92.982127]  drm_ioctl+0x1f8/0x4dc [drm]
[   92.986098]  __arm64_sys_ioctl+0xac/0x104
[   92.990102]  invoke_syscall+0x54/0x10c
[   92.993842]  el0_svc_common.constprop.0+0x40/0xe0
[   92.998532]  do_el0_svc+0x1c/0x28
[   93.001835]  el0_svc+0x38/0x11c
[   93.004969]  el0t_64_sync_handler+0xa0/0xe4
[   93.009139]  el0t_64_sync+0x198/0x19c
[   93.012792] Code: aa1703e0 d2800014 95cb0ba4 17ffffe8 (f940a400)
[   93.018869] ---[ end trace 0000000000000000 ]---

Fixes: d2d79d29bb98 ("drm/imagination: Implement context creation/destruction ioctls")
Cc: stable@vger.kernel.org
Signed-off-by: Luigi Santivetti 
Reviewed-by: Alessio Belle 
Link: https://patch.msgid.link/20260707-staging-ddkopsrc-2435-v1-1-24e160d44476@imgtec.com
Signed-off-by: Alessio Belle

drm/imagination: make pvr_fw_trace_init_mask_ops static

2026-07-09T14:07:23+00:00

The pvr_fw_trace_init_mask_ops is not used outside pvr_fw_trace.c
so make it static to avoid the following sparse warning:

drivers/gpu/drm/imagination/pvr_fw_trace.c:74:31: warning: symbol 'pvr_fw_trace_init_mask_ops' was not declared. Should it be static?

Fixes: c6978643ea1c ("drm/imagination: Validate fw trace group_mask")
Reviewed-by: Alessio Belle 
Signed-off-by: Ben Dooks 
Link: https://patch.msgid.link/20260703162338.2848039-1-ben.dooks@codethink.co.uk
Signed-off-by: Alessio Belle

Merge tag 'drm-fixes-2026-07-04' of https://gitlab.freedesktop.org/drm/kernel

2026-07-04T01:42:20+00:00

Pull drm fixes from Dave Airlie:
 "Weekly fixes for drm. This is large for rc2 but it's just a lot of
  small fixes across a bunch of drivers, xe, amdgpu as usual, plus some
  sashiko-inspired fixes for panthor, and some dma-fence updates.

  core:
   - kernel doc fix
   - include types.h in drm_ras.h

  dma-fence:
   - fix NULL ptr dereference
   - use correct callback
   - make dma_fence_dedup_array more robust

  dp:
   - handle torn down topology gracefully
   - fix kernel doc

  i915:
   - Input validation fixes for BIOS and EDID
   - Fix HDCP code buffer overflow and seq_num_v monotonic increase check
   - Fix near-NULL deref in i915_active during GFP_ATOMIC exhaustion

  xe:
   - Wedge from the timeout handler only after releasing the queue
   - Fix a NULL pointer dereference
   - Remove redundant exec_queue_suspended
   - RTP / OA whitelist fixes
   - Return error on non-migratable faults requiring devmem
   - Skip FORCE_WC and vm_bound check for external dma-bufs
   - Hold notifier lock for write on inject test path
   - Drop bogus static from finish in force_invalidate
   - Fix double-free of managed BO in error path
   - Don't attempt to process FAST_REQ or EVENT relays
   - Fix NPD in bo_meminfo
   - Prevent invalid cursor access for purged BOs
   - Fix offset alignment for MERT WHITELST_OA_MERT_MMIO_TRG

  amdgpu:
   - Soc24 aborted suspend fix
   - Drop unecessary BUG() and BUG_ON() from error paths
   - SCPM fix
   - Power reporting fix
   - DCE HDR fix
   - UVD boundary checks
   - VCN boundary checks
   - VCE boundary checks
   - DCN 4.2 fixes
   - Large stack allocation fixes
   - Fix aperture mapping leak
   - UserQ fixes
   - Ignore_damage_clips fix
   - ACP fixes
   - DC boundary checks
   - GPUVM fixes
   - JPEG idle check fixes
   - Userptr fix
   - GC 11.7 updates
   - Non-4K page fix
   - SMU 13 fixes
   - DP alt mode fix

  amdkfd:
   - Boundary checks
   - CRIU fixes

  amdxdna:
   - fix device removal issues
   - fix use after free in debug BO

  imagination:
   - fix double call to scheduler fini
   - fix ioctl return values
   - fix user array stride

  virtio:
   - handle EDIDs better

  panthor:
   - irq safe fence lock fix
   - reset work fix
   - fix invalid pointer
   - fix iomem access in suspended state
   - sched resume fix
   - unplug suspend fix
   - drop needless check
   - eviction leak fix
   - bail on group start/resume fix
   - keep irqs masked

  malidp:
   - use clock bulk API

  komeda:
   - clock prepare fixes"

* tag 'drm-fixes-2026-07-04' of https://gitlab.freedesktop.org/drm/kernel: (105 commits)
  drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG
  drm/xe/pt: prevent invalid cursor access for purged BOs
  drm/xe: fix NPD in bo_meminfo()
  drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays
  drm/xe/hw_engine: Fix double-free of managed BO in error path
  drm/xe/userptr: Drop bogus static from finish in force_invalidate
  drm/xe/userptr: Hold notifier_lock for write on inject test path
  drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs
  drm/xe: Return error on non-migratable faults requiring devmem
  drm/xe/rtp: Ensure locking/ref counting for OA whitelists
  drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
  drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
  drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
  drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
  drm/xe/rtp: Generalize whitelist_apply_to_hwe
  drm/xe/rtp: Keep track of non-OA nonpriv slots
  drm/xe/rtp: Maintain OA whitelists separately
  drm/xe/rtp: Fix build error with clang < 21 and non-const initializers
  drm/imagination: Fix user array stride in pvr_set_uobj_array()
  drm/imagination: Fix returned size for DRM_IOCTL_PVR_DEV_QUERY
  ...

Replace by more specific (c files)

2026-07-03T05:38:17+00:00

Replace the #include of  by the more specific
 where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich 
Acked-by: Takashi Sakamoto 
Acked-by: Bjorn Helgaas 
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub)

drm/imagination: Fix user array stride in pvr_set_uobj_array()

2026-07-02T10:16:18+00:00

pvr_set_uobj_array() copies an array of kernel objects to a userspace
array whose element size is described by out->stride. When out->stride
is different from the kernel object size, the slow path advances the
userspace pointer by the kernel object size and the kernel pointer by the
userspace stride.

This reverses the intended layout. For larger userspace strides, later
copies read from the wrong kernel addresses. For smaller userspace
strides, later copies are written at the wrong userspace offsets. The
padding clear is also done only for the first element instead of the
padding area for each element.

Advance the userspace pointer by out->stride and the kernel pointer by
obj_size, and clear per-element padding while the current userspace
pointer is still available.

Fixes: f99f5f3ea7ef ("drm/imagination: Add GPU ID parsing and firmware loading")
Cc: stable@vger.kernel.org # v6.8+
Reviewed-by: Alessio Belle 
Signed-off-by: Shuvam Pandey 
Link: https://patch.msgid.link/6a456012.eb165e5c.113c2a.b71d@mx.google.com
Signed-off-by: Alessio Belle