Merge tag 'drm-fixes-2026-07-10' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly fixes pull for drm, amdgpu, amdxdna, xe leading the way, some
  small core fixes and a nouveau stability fix along with some minor
  changes in other drivers.

  Seems to be a bit quiter than last week at least.

  fb-helper:
   - Sync on first active crtc in fb_dirty, rather than first crtc

  drm_exec:
   - Use direct label in drm_exec

  buddy:
   - Rework try_harder in the buddy allocator

  i915:
   - fix underrun on panthor lake
   - LT PHY SSC programming fix
   - fix some NULL derefs and leaks

  nouveau:
   - fix a vmm large/small page table update race

  xe:
   - Fix PTE index in xe_vm_populate_pgtable for chunked binds
   - Wait on external BO kernel fences in exec IOCTL
   - Remove duplicate include
   - Free madvise VMA array on L2 flush failure
   - Stub notifier_lock helpers when DRM_GPUSVM=n

  amdgpu:
   - PSP 15.0.9 update
   - SMU 15.0.9 update
   - VCN 5.3 fix
   - VI ASPM fix
   - Userq fix
   - lifetime fix for amdgpu_vm_get_task_info_pasid()
   - Gfx10 fix
   - SMU 14 fix

  amdkfd:
   - CRIU bounds checking fixes
   - secondary context id fix
   - Event bounds checking fix

  amdxdna:
   - Fix uaf in mmap failure path
   - A lot of deadlocks, access races and return value fixes

  analogix_dp:
   - Fix analogix_dp bitshifts during link training

  v3d:
   - Fix absent indirect bo handling

  imagination:
   - Make function static to solve compiler warning
   - Fix error checking"

* tag 'drm-fixes-2026-07-10' of https://gitlab.freedesktop.org/drm/kernel: (44 commits)
  nouveau/vmm: fix another SPT/LPT race
  drm/imagination: fix error checking of pvr_vm_context_lookup()
  drm/imagination: make pvr_fw_trace_init_mask_ops static
  gpu/buddy: bail out of try_harder when alignment cannot be honoured
  drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n
  drm/xe: free madvise VMA array on L2 flush failure
  drm/xe: remove duplicate <kunit/test-bug.h> include
  drm/xe: Wait on external BO kernel fences in exec IOCTL
  drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
  drm/fb-helper: Only consider active CRTCs for vblank sync
  drm/amdkfd: Check bounds on CRIU restore queue type and mqd size
  drm/amd/pm: fix smu14 power limit range calculation
  drm/amdkfd: Check bounds in allocate_event_notification_slot
  amdkfd: properly free secondary context id
  drm/amdkfd: Don't acquire buffers during CRIU queue restore
  drm/amdkfd: Check bounds on CRIU restore event id
  drm/gfx10: Program DB_RING_CONTROL
  drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
  drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue
  drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled
  ...

1 files changed, 18 insertions, 16 deletions

diff --git a/include/drm/drm_exec.h b/include/drm/drm_exec.h
index 8725ba92ff91..cc2937185a9f 100644
--- a/include/drm/drm_exec.h
+++ b/include/drm/drm_exec.h
@@ -101,17 +101,6 @@ drm_exec_obj(struct drm_exec *exec, unsigned long index)
 #define drm_exec_for_each_locked_object_reverse(exec, obj)		\
 	__drm_exec_for_each_locked_object_reverse(exec, obj, __UNIQUE_ID(drm_exec))
 
-/*
- * Helper to drm_exec_until_all_locked(). Don't use directly.
- *
- * Since labels can't be defined local to the loop's body we use a jump pointer
- * to make sure that the retry is only used from within the loop's body.
- */
-#define __drm_exec_until_all_locked(exec, _label)			 \
-_label:									 \
-	for (void *const __maybe_unused __drm_exec_retry_ptr = &&_label; \
-	     drm_exec_cleanup(exec);)
-
 /**
  * drm_exec_until_all_locked - loop until all GEM objects are locked
  * @exec: drm_exec object
@@ -119,9 +108,18 @@ _label:									 \
  * Core functionality of the drm_exec object. Loops until all GEM objects are
  * locked and no more contention exists. At the beginning of the loop it is
  * guaranteed that no GEM object is locked.
+ *
+ * A global label name drm_exec_retry is used, if you need to use more than one
+ * instance of this macro in the same function the label needs to be made local
+ * to the block with the __label__ keyword.
  */
 #define drm_exec_until_all_locked(exec)					\
-	__drm_exec_until_all_locked(exec, __UNIQUE_ID(drm_exec))
+	for (bool const __maybe_unused __drm_exec_loop = false;		\
+	     drm_exec_cleanup(exec);)					\
+		if (false) {						\
+drm_exec_retry: __maybe_unused;						\
+			continue;					\
+		} else
 
 /**
  * drm_exec_retry_on_contention - restart the loop to grap all locks
@@ -129,12 +127,14 @@ _label:									 \
  *
  * Control flow helper to continue when a contention was detected and we need to
  * clean up and re-start the loop to prepare all GEM objects.
+ * The __drm_exec_loop check exists to prevent usage outside of an
+ * drm_exec_until_all_locked() loop.
  */
 #define drm_exec_retry_on_contention(exec)			\
 	do {							\
 		if (unlikely(drm_exec_is_contended(exec)))	\
-			goto *__drm_exec_retry_ptr;		\
-	} while (0)
+			goto drm_exec_retry;			\
+	} while (__drm_exec_loop)
 
 /**
  * drm_exec_is_contended - check for contention
@@ -154,12 +154,14 @@ static inline bool drm_exec_is_contended(struct drm_exec *exec)
  *
  * Unconditionally retry the loop to lock all objects. For consistency,
  * the exec object needs to be newly initialized.
+ * The __drm_exec_loop check exists to prevent usage outside of an
+ * drm_exec_until_all_locked() loop.
  */
 #define drm_exec_retry(_exec)					\
 	do {							\
 		WARN_ON((_exec)->contended != DRM_EXEC_DUMMY);	\
-		goto *__drm_exec_retry_ptr;			\
-	} while (0)
+		goto drm_exec_retry;				\
+	} while (__drm_exec_loop)
 
 /**
  * drm_exec_ticket - return the ww_acquire_ctx for this exec context