linux.git/drivers/gpu/drm/nouveau, branch master Linux kernel source tree nouveau/vmm: fix another SPT/LPT race 2026-07-10T04:19:23+00:00 Dave Airlie airlied@redhat.com 2026-06-15T04:47:37+00:00 6763a0aea6d658d69b9215ab9151d7bd4c1c314b We've had an unknown Turing issue for a while with page faults since large pages and compression. I've got a patch series that syncs all our L2 handling with ogkm and it made this fault happen more. After writing a bunch of debugging patches, I spotted an invalid LPT entry where there should have been a valid one. A 64K MAP succeeds on a range, but a subsequent SPT put drops SPT refs across multiple ranges, We shouldn't assume all ranges where SPTEs go away will have the same sparse/invalid/valid state, just iterate over each instead and do the right thing. Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com> Fixes: d19512f5abb1 ("nouveau/vmm: start tracking if the LPT PTE is valid. (v6)") Link: https://patch.msgid.link/20260615044737.3419585-1-airlied@gmail.com [ Properly format commit message. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org> (cherry picked from commit d008141ed4ce924167a03d46fbce9ad1fe4efa29) Signed-off-by: Dave Airlie <airlied@redhat.com> 
We've had an unknown Turing issue for a while with page faults since
large pages and compression.

I've got a patch series that syncs all our L2 handling with ogkm and it
made this fault happen more.

After writing a bunch of debugging patches, I spotted an invalid LPT
entry where there should have been a valid one.

A 64K MAP succeeds on a range, but a subsequent SPT put drops SPT refs
across multiple ranges,

We shouldn't assume all ranges where SPTEs go away will have the same
sparse/invalid/valid state, just iterate over each instead and do the
right thing.

Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Fixes: d19512f5abb1 ("nouveau/vmm: start tracking if the LPT PTE is valid. (v6)")
Link: https://patch.msgid.link/20260615044737.3419585-1-airlied@gmail.com
[ Properly format commit message. - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
(cherry picked from commit d008141ed4ce924167a03d46fbce9ad1fe4efa29)
Signed-off-by: Dave Airlie <airlied@redhat.com>
Merge tag 'drm-fixes-2026-06-27' of https://gitlab.freedesktop.org/drm/kernel 2026-06-27T00:03:48+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-06-27T00:03:48+00:00 5a66900afbd6b2a063eebad35294038a654de2b0 Pull drm fixes from Dave Airlie: "These are just the fixes from our fixes branch, all pretty small and scattered. sysfb: - drm/sysfb truncation and alignment fixes edid: - fix edid OOB read in tile parsing - increase displayid topology id to correct size nouveau: - fix error handling paths in nouveau amdxdna: - get_bo_info fix ivpu: - fix leak when error handling in ivpu" * tag 'drm-fixes-2026-06-27' of https://gitlab.freedesktop.org/drm/kernel: drm/sysfb: Avoid truncating maximum stride drm/sysfb: Return errno code from drm_sysfb_get_visible_size() drm/sysfb: Avoid possible truncation with calculating visible size drm/sysfb: Do not page-align visible size of the framebuffer drm/edid: fix OOB read in drm_parse_tiled_block() drm/nouveau: fix reversed error cleanup order in ucopy functions drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() accel/amdxdna: Use caller client for debug BO sync drm/displayid: fix Tiled Display Topology ID size accel/ivpu: fix HWS command queue leak on registration failure 
Pull drm fixes from Dave Airlie:
 "These are just the fixes from our fixes branch, all pretty small and
  scattered.

  sysfb:
   - drm/sysfb truncation and alignment fixes

  edid:
   - fix edid OOB read in tile parsing
   - increase displayid topology id to correct size

  nouveau:
   - fix error handling paths in nouveau

  amdxdna:
   - get_bo_info fix

  ivpu:
   - fix leak when error handling in ivpu"

* tag 'drm-fixes-2026-06-27' of https://gitlab.freedesktop.org/drm/kernel:
  drm/sysfb: Avoid truncating maximum stride
  drm/sysfb: Return errno code from drm_sysfb_get_visible_size()
  drm/sysfb: Avoid possible truncation with calculating visible size
  drm/sysfb: Do not page-align visible size of the framebuffer
  drm/edid: fix OOB read in drm_parse_tiled_block()
  drm/nouveau: fix reversed error cleanup order in ucopy functions
  drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()
  accel/amdxdna: Use caller client for debug BO sync
  drm/displayid: fix Tiled Display Topology ID size
  accel/ivpu: fix HWS command queue leak on registration failure
drm/nouveau: fix reversed error cleanup order in ucopy functions 2026-06-21T13:15:23+00:00 Junrui Luo moonafterrain@outlook.com 2026-06-10T10:01:28+00:00 ab99ead646b1b833ecd57fe577a2816f2e848167 nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error cleanup labels in allocation order rather than reverse allocation order. On a u_memcpya() failure for in_sync.s, the goto to err_free_ops (or err_free_pushs) frees the first allocation and then falls through to err_free_ins, which calls u_free() on args->in_sync.s. Since args->in_sync.s still holds the ERR_PTR returned by the failed u_memcpya(), and ERR_PTR values are not caught by ZERO_OR_NULL_PTR(), kvfree() proceeds to dereference it, which can result in a kernel oops. A failure for out_sync.s instead jumps to err_free_ins and skips freeing the first allocation, leading to a memory leak. Fix by swapping the cleanup label order so resources are freed in the correct reverse allocation sequence. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Reported-by: Yuhao Jiang <danisjiang@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Link: https://patch.msgid.link/SYBPR01MB7881484D91A6F80271415F71AF1A2@SYBPR01MB7881.ausprd01.prod.outlook.com Signed-off-by: Danilo Krummrich <dakr@kernel.org> 
nouveau_uvmm_vm_bind_ucopy() and nouveau_exec_ucopy() place their error
cleanup labels in allocation order rather than reverse allocation order.
On a u_memcpya() failure for in_sync.s, the goto to err_free_ops (or
err_free_pushs) frees the first allocation and then falls through to
err_free_ins, which calls u_free() on args->in_sync.s.

Since args->in_sync.s still holds the ERR_PTR returned by the failed
u_memcpya(), and ERR_PTR values are not caught by ZERO_OR_NULL_PTR(),
kvfree() proceeds to dereference it, which can result in a kernel oops.
A failure for out_sync.s instead jumps to err_free_ins and skips freeing
the first allocation, leading to a memory leak.

Fix by swapping the cleanup label order so resources are freed in the
correct reverse allocation sequence.

Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB7881484D91A6F80271415F71AF1A2@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() 2026-06-21T13:06:01+00:00 Wentao Liang vulab@iscas.ac.cn 2026-06-06T15:56:06+00:00 c3027973f692077a1b66a9fb26d6a7c46c0dc72c In nvkm_acr_oneinit(), nvkm_kmap(acr->wpr) is invoked unconditionally at line 309 to obtain a mapping reference. Additionally, when both acr->wpr_fw and acr->wpr_comp are present, a second nvkm_kmap() is called inside the conditional block. Both mappings are expected to be released by nvkm_done(acr->wpr) at line 320 before the function returns successfully. However, when a mismatch is detected during the loop within the conditional block, the function returns -EINVAL at line 318 without calling nvkm_done(). This results in a leak of the kmap reference(s) acquired earlier. Fix the issue by invoking nvkm_done(acr->wpr) prior to the early return to ensure proper release of the mapping references. Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Link: https://patch.msgid.link/20260606155606.77593-1-vulab@iscas.ac.cn Signed-off-by: Danilo Krummrich <dakr@kernel.org> 
In nvkm_acr_oneinit(), nvkm_kmap(acr->wpr) is invoked unconditionally
at line 309 to obtain a mapping reference. Additionally, when both
acr->wpr_fw and acr->wpr_comp are present, a second nvkm_kmap() is
called inside the conditional block. Both mappings are expected to be
released by nvkm_done(acr->wpr) at line 320 before the function returns
successfully.

However, when a mismatch is detected during the loop within the
conditional block, the function returns -EINVAL at line 318 without
calling nvkm_done(). This results in a leak of the kmap reference(s)
acquired earlier.

Fix the issue by invoking nvkm_done(acr->wpr) prior to the early return
to ensure proper release of the mapping references.

Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260606155606.77593-1-vulab@iscas.ac.cn
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Merge tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc 2026-06-17T18:21:40+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-06-17T18:21:40+00:00 70cb95c736807da2c4952423c9f9afe470341996 Pull SoC driver updates from Arnd Bergmann: "There are a few added drivers, but mostly the normal maintenance to drivers for firmware, memory controller and other soc specific hardware: - The NXP QuickEngine gets modern MSI support, which allows some cleanups to the GICv3 irqchip chip driver - A new SoC specific driver for the Renesas R-Car MFIS unit is added, encapsulating support for the on-chip mailbox and hwspinlock implementations that are not easily separated into individual drivers - The Qualcomm SoC drivers add support for additional SoC implementations, and flexibility around power management for the serial-engine driver as well as probing the LLCC driver using custom hardware descriptions inside of the device itself. - Added support for the Samsung thermal management unit - A cleanup to the Tegra 'PMC' driver interfaces to remove legacy APIs and allow multiple PMC instances everywhere. - Updates to the TI SCI and KNAS drivers to improve suspend/resume support. - Minor driver changes for mediatek, xilinx, allwinner, aspeed, tegra, broadcom, amd, microchip and starfive specific drivers - Memory controller updates for Tegra and Renesas for additional SoC types and other improvements. - Firmware driver updates for Arm FF-A, SMCCC and SCMI interfaces, to update driver probing, object lifetimes and address minor bugs" * tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (189 commits) Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface" Revert "Documentation: ABI: add sysfs interface for ZynqMP CSU registers" memory: tegra234: drop dead NULL check in tegra234_mc_icc_aggregate() memory: tegra264: drop redundant tegra264_mc_icc_aggregate() memory: tegra186-emc: stop borrowing MC aggregate hook for EMC soc: aspeed: cleanup dead default for ASPEED_SOCINFO firmware: tegra: bpmp: Add support for multi-socket platforms firmware: tegra: bpmp: Propagate debugfs errors soc/tegra: pmc: Add Tegra238 support soc/tegra: pmc: Restrict power-off handler to Nexus 7 soc/tegra: pmc: Populate powergate debugfs only when needed soc/tegra: pmc: Move legacy code behind CONFIG_ARM guard soc/tegra: pmc: Remove unused legacy functions soc/tegra: pmc: Create PMC context dynamically firmware: samsung: acpm: remove compile-testing stubs firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper firmware: samsung: acpm: Add TMU protocol support firmware: samsung: acpm: Make acpm_ops const and access via pointer firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr ... 
Pull SoC driver updates from Arnd Bergmann:
 "There are a few added drivers, but mostly the normal maintenance to
  drivers for firmware, memory controller and other soc specific
  hardware:

   - The NXP QuickEngine gets modern MSI support, which allows some
     cleanups to the GICv3 irqchip chip driver

   - A new SoC specific driver for the Renesas R-Car MFIS unit is added,
     encapsulating support for the on-chip mailbox and hwspinlock
     implementations that are not easily separated into individual
     drivers

   - The Qualcomm SoC drivers add support for additional SoC
     implementations, and flexibility around power management for the
     serial-engine driver as well as probing the LLCC driver using
     custom hardware descriptions inside of the device itself.

   - Added support for the Samsung thermal management unit

   - A cleanup to the Tegra 'PMC' driver interfaces to remove legacy
     APIs and allow multiple PMC instances everywhere.

   - Updates to the TI SCI and KNAS drivers to improve suspend/resume
     support.

   - Minor driver changes for mediatek, xilinx, allwinner, aspeed,
     tegra, broadcom, amd, microchip and starfive specific drivers

   - Memory controller updates for Tegra and Renesas for additional SoC
     types and other improvements.

   - Firmware driver updates for Arm FF-A, SMCCC and SCMI interfaces, to
     update driver probing, object lifetimes and address minor bugs"

* tag 'soc-drivers-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (189 commits)
  Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface"
  Revert "Documentation: ABI: add sysfs interface for ZynqMP CSU registers"
  memory: tegra234: drop dead NULL check in tegra234_mc_icc_aggregate()
  memory: tegra264: drop redundant tegra264_mc_icc_aggregate()
  memory: tegra186-emc: stop borrowing MC aggregate hook for EMC
  soc: aspeed: cleanup dead default for ASPEED_SOCINFO
  firmware: tegra: bpmp: Add support for multi-socket platforms
  firmware: tegra: bpmp: Propagate debugfs errors
  soc/tegra: pmc: Add Tegra238 support
  soc/tegra: pmc: Restrict power-off handler to Nexus 7
  soc/tegra: pmc: Populate powergate debugfs only when needed
  soc/tegra: pmc: Move legacy code behind CONFIG_ARM guard
  soc/tegra: pmc: Remove unused legacy functions
  soc/tegra: pmc: Create PMC context dynamically
  firmware: samsung: acpm: remove compile-testing stubs
  firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper
  firmware: samsung: acpm: Add TMU protocol support
  firmware: samsung: acpm: Make acpm_ops const and access via pointer
  firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members
  firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr
  ...
Revert "nouveau/gsp: cleanup IS_ERR_OR_NULL in rm_alloc functions" 2026-05-28T20:49:53+00:00 Lyude Paul lyude@redhat.com 2026-05-28T19:27:19+00:00 18178f2ac176f4b1e1c0555bed9d66b04fdf171e This is probably too risky, see the discussion here: https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html This reverts commit 281fe11c6c4aebc1a1eb9d21eaab7323ee5af979. Signed-off-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260528192847.4077458-6-lyude@redhat.com Signed-off-by: Danilo Krummrich <dakr@kernel.org> 
This is probably too risky, see the discussion here:

  https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html

This reverts commit 281fe11c6c4aebc1a1eb9d21eaab7323ee5af979.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Timur Tabi <ttabi@nvidia.com>
Link: https://patch.msgid.link/20260528192847.4077458-6-lyude@redhat.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Revert "nouveau/gsp: cleanup IS_ERR_OR_NULL in rpc_rd" 2026-05-28T20:49:53+00:00 Lyude Paul lyude@redhat.com 2026-05-28T19:27:18+00:00 80fa10569b90a1ac6aeb771c5e149c67027f36e8 This is probably much too risky. See the discussion here: https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html This reverts commit 47f15f6cf068c14d1a5054066c445bee23f6047e. Signed-off-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260528192847.4077458-5-lyude@redhat.com Signed-off-by: Danilo Krummrich <dakr@kernel.org> 
This is probably much too risky. See the discussion here:

  https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html

This reverts commit 47f15f6cf068c14d1a5054066c445bee23f6047e.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Timur Tabi <ttabi@nvidia.com>
Link: https://patch.msgid.link/20260528192847.4077458-5-lyude@redhat.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Revert "nouveau/gsp/rm: cleanup WARN_ON(IS_ERR_OR_NULL)" 2026-05-28T20:49:53+00:00 Lyude Paul lyude@redhat.com 2026-05-28T19:27:17+00:00 dd516da348f1b9fd6c6d6a6f14f0dd491f523658 This is probably too risky, see the discussion here: https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html This reverts commit 6198977a78af8769d3f3108e830901325b97cf03. Signed-off-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260528192847.4077458-4-lyude@redhat.com Signed-off-by: Danilo Krummrich <dakr@kernel.org> 
This is probably too risky, see the discussion here:

  https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html

This reverts commit 6198977a78af8769d3f3108e830901325b97cf03.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Timur Tabi <ttabi@nvidia.com>
Link: https://patch.msgid.link/20260528192847.4077458-4-lyude@redhat.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Revert "nouveau/gsp/rm: cleanup IS_ERR_OR_NULL in core implementation" 2026-05-28T20:49:52+00:00 Lyude Paul lyude@redhat.com 2026-05-28T19:27:16+00:00 1a8117455d0d6004d5398fcd2a4717a930eb307e This is probably too risky, see the discussion here: https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html This reverts commit 67346c90ce275e835e93a4a13041afee47bd3f9e. Signed-off-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260528192847.4077458-3-lyude@redhat.com Signed-off-by: Danilo Krummrich <dakr@kernel.org> 
This is probably too risky, see the discussion here:

  https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html

This reverts commit 67346c90ce275e835e93a4a13041afee47bd3f9e.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Timur Tabi <ttabi@nvidia.com>
Link: https://patch.msgid.link/20260528192847.4077458-3-lyude@redhat.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Revert "nouveau/gsp/rm: cleanup remaining IS_ERR_OR_NULL usage" 2026-05-28T20:49:52+00:00 Lyude Paul lyude@redhat.com 2026-05-28T19:27:15+00:00 ebddb00faa82783d26276c9839f84bfd33a6479b This reverts commit 1a80c009e27b42e8c202d4c5dbd9dad9e22af742. Embarassingly, it seems that I completely missed a pretty big issue this patch causes according to Danilo and Sashiko: https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html Where it seems this causes some machines to segfault during nouveau probe. So, revert this for the time being. Signed-off-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260528192847.4077458-2-lyude@redhat.com Signed-off-by: Danilo Krummrich <dakr@kernel.org> 
This reverts commit 1a80c009e27b42e8c202d4c5dbd9dad9e22af742.

Embarassingly, it seems that I completely missed a pretty big issue this
patch causes according to Danilo and Sashiko:

https://lists.freedesktop.org/archives/dri-devel/2026-May/570353.html

Where it seems this causes some machines to segfault during nouveau probe.

So, revert this for the time being.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Timur Tabi <ttabi@nvidia.com>
Link: https://patch.msgid.link/20260528192847.4077458-2-lyude@redhat.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>