summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)AuthorFilesLines
2026-07-08drm/amdgpu/gfx11: WARN() rather than BUG() for invalid SDMA engineAlex Deucher1-1/+2
There's no need to crash the kernel for these cases. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: return an error instead of BUG() for CSA bo_vaAlex Deucher1-1/+2
If the bo_va is not present, return an error rather than crashing the kernel. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/gfx11: enable gfx pipe1 hardware supportAlex Deucher1-5/+17
Enable gfx pipe1 hardware support. This is only available on gfx11 chips using the F32 microcontroller. Chips using the RS64 microcontroller are not able to use the second gfx pipe. In practice this means the second pipe is only available on APUs. This explains the stability issues Pierre-Eric saw previously with this on Navi33. Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/gfx12: Program DB_RING_CONTROLAlex Deucher1-0/+9
This is needed to allocate occlusion counters across both gfx pipes. GFX 12 only has one gfx pipe, so no functional change since the default value is 1. Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/gfx11: Program DB_RING_CONTROLAlex Deucher1-0/+9
This is needed to allocate occlusion counters across both gfx pipes. No functional change since we only use one gfx pipe at the moment (default value is 1). Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/gfx10: Program DB_RING_CONTROLAlex Deucher1-0/+9
This is needed to allocate occlusion counters across both gfx pipes. Fixes: b7a1a0ef12b8 ("drm/amd/amdgpu: add pipe1 hardware support") Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: Check bounds in allocate_event_notification_slotDavid Francis1-0/+3
The valid event ids go from 0 to KFD_SIGNAL_EVENT_LIMIT allocate_event_notification_slot has an option to specify an event id to allocate at, used by CRIU. We weren't checking the bounds on that value. Check them. v2: Lower bounds check is unecessary because of idr_alloc already rejecting negative numbers. Upper bounds check should be KFD_SIGNAL_EVENT_LIMIT since the signal mode mappings might not yet exist Signed-off-by: David Francis <David.Francis@amd.com> Reviewed-by: David Yat Sin <david.yatsin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08amdkfd: properly free secondary context idZhu Lingshan1-1/+1
Function kfd_process_free_id() should skip over the primary kfd process because its context id is fixed assigned, not allocated through the ida table. This function should only work on secondary contexts. Fixes: fac682a1d1af ("amdkfd: identify a secondary kfd process by its id") Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: Don't acquire buffers during CRIU queue restore.David Francis1-8/+5
kfd_criu_restore_queue's call of kfd_queue_acquire_buffers was failing for multiple reasons - The ctl_stack_size set by the CRIU plugin doesn't match what is expected by acquire_buffers - The svm buffer cannot be acquired at this point because CRIU may not have restored it, or may have restored it to a different address. The only reason acquire_buffers was necessary here was to avoid a null ptr dereference in init_user_queue. Just put in a check for that dereference; it doesn't appear to come up in real use cases right now. That is, there is no usage of CRIU with shared MES. This is a partial revert of commit 20a5e7ffdfec ("drm/amdkfd: Properly acquire queue buffers in CRIU restore") Fixes: 20a5e7ffdfec ("drm/amdkfd: Properly acquire queue buffers in CRIU restore") Reviewed-by: David Yat Sin <david.yatsin@amd.com> Signed-off-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: Check bounds on CRIU restore queue type and mqd sizeDavid Francis4-8/+27
We weren't checking whether the values provided in the private data in kfd CRIU restore were within bounds. For queue type, add a KFD_QUEUE_TYPE_MAX and ensure the provided type is less than it. For mqd_size, add new function mqd_size_from_queue_type and confirm that the provided mqd_size matches expectations. Reviewed-by: David Yat Sin <david.yatsin@amd.com> Signed-off-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()Shahyan Soltani1-15/+10
The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only valid while the lock is still being held. Once xa_unlock_irqrestore is called and returned, the pointer is no longer under lock and is subject to modification. Since, the caller still dereferences vm->task_info in amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a use after unlock problem. Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid() through removing the amdgpu_vm_get_vm_from_pasid() function from amdgpu_vm.c and making the relevant code inline to hold the lock while it is still in use. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: include amdgpu_video_codecs.h only where neededShahyan Soltani11-1/+11
Remove #include "amdgpu_video_codecs.h" from amdgpu.h and add forward declaration of struct amdgpu_video_codecs. Add #include "amdgpu_video_codecs.h" into files amdgpu_kms.c, amdgpu_virt.c, cik.c, nv.c, si.c, soc15.c, soc21.c, soc24.c, soc_v1_0.c, and vi.c. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move amdgpu_allowed_register_entry into amdgpu_reg_access.hShahyan Soltani2-8/+8
Move struct amdgpu_allowed_register_entry from monolithic amdgpu.h file into existing amdgpu_reg_access.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move amdgpu_acpi helpers into new headerShahyan Soltani2-121/+152
Move struct amdgpu_uma_carveout_option, struct amdgpu_uma_carveout_info, struct amdgpu_numa_info, and relevant acpi helpers from the monolithic amdgpu.h header file into a new amdgpu_acpi.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amd/display: Fix sign mismatch warningGeorge Zhang1-3/+3
Using mismatched signedness (int and uint32_t) causes a -Wsign-compare warning. Fix it by changing the min macro to min_t to explicitly cast. Fixes: 8cbe3648aa86 ("drm/amd/display: clamp DMUB AUX reply length to payload buffer") Signed-off-by: George Zhang <george.zhang@amd.com> Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move struct amdgpu_mqd and helpers into header fileShahyan Soltani2-47/+47
Move struct amdgpu_mqd_prop, struct amdgpu_mqd, and helpers from the monolithic amdgpu.h into existing amdgpu_mes.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move struct amdgpu_video_codecs and helpers into header fileShahyan Soltani2-20/+48
Move struct amdgpu_video_codec_info, struct amdgpu_video_codecs, and helpers into a new amdgpu_video_codecs.h file. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: move struct amdgpu_wb and helpers into separate filesShahyan Soltani33-285/+349
Move struct amdgpu_wb and helpers out of the monolithic header amdgpu.h into its own dedicated header amdgpu_wb.h. Add amdgpu_wb_init() and amdgpu_wb_fini() into amdgpu_wb.h. Move functions amdgpu_device_wb_get(), amdgpu_device_wb_free(), amdgpu_device_wb_init(), and amdgpu_device_wb_fini() out of amdgpu_device.c into new dedicated amdgpu_wb.c file. Removed static from functions amdgpu_device_wb_init() and amdgpu_device_wb_fini(). Rename functions amdgpu_device_wb_get(), amdgpu_device_wb_free(), amdgpu_device_wb_init(), and amdgpu_device_wb_fini() into amdgpu_wb_get(), amdgpu_wb_free(), amdgpu_wb_init(), and amdgpu_wb_fini(). Update amdgpu/Makefile to build amdgpu_wb.o. This is part of the ongoing effort to reduce the size of amdgpu.h into their own respective separate headers. Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/mes12: Remove MES self testSrinivasan Shanmugam1-333/+1
The MES self test is no longer needed. Other MES versions already dropped their self tests since IGT now covers this functionality. Remove the MES v12 self test as well. Cc: Alex Deucher <alexander.deucher@amd.com> Suggested-by: Christian König <christian.koenig@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queueJesse Zhang1-0/+9
Destroying a hung user queue issues a MES REMOVE_QUEUE that times out, The destroy path only logged the error and freed the queue, so the next userq submission failed and forced a GPU reset attributed to an innocent workload. Kick the userq reset work when unmap fails so the GPU is recovered at destroy time. Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabledKenneth Feng1-1/+2
Disable ASPM on VI if PCIE dpm is disabled. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5370 Signed-off-by: Kenneth Feng <kenneth.feng@amd.com> Reviewed-by: Yang Wang <kevinyang.wang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy deferred error separate loggingCe Sun5-131/+23
Remove the legacy logic that logs deferred errors separately Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy get_retire_flip_bits interface for UMCCe Sun2-19/+0
Remove the legacy general get_retire_flip_bits interface for UMC Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy get_retire_flip_bits for UMCCe Sun1-106/+0
Remove the legacy get_retire_flip_bits implementation for UMC v12 Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy mca umc status check interfaceCe Sun3-24/+0
Remove the legacy interface to check mca umc status Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amd/pm: retire legacy ras_smu_drv interface for smu v13.0.12Ce Sun3-157/+0
Remove the legacy ras_smu_drv interface implementation for SMU v13.0.12 Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCCGeoffrey McRae1-1/+1
The loop iterated only AMDGPU_MAX_MES_PIPES times, leaving entries uninitialized for multi-XCC GPUs. This causes null pointer dereferences when accessing arrays indexed by XCC ID >= 2. Extend the loop to cover all XCCs (AMDGPU_MAX_MES_PIPES * num_xcc), matching other per-XCC arrays. Fixes: a132fc9bc2f8 ("drm/amdgpu: Fixup boost mes detect hang array size") Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com> Reviewed-by: Amber Lin <amber.lin@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: use iosys_map for CWSR buffer accessJames Zhu2-20/+49
After moving TBA/TMA from GTT to VRAM for GFX9.4.2+ in commit 5088a1ba6d6d ("drm/amdkfd: move TBA/TMA from system to device memory"), direct pointer dereferences to CWSR buffers became unsafe because VRAM is accessed via MMIO (PCI BAR mappings). Direct writes like 'tma[2] = enabled' and memcpy() can fail or produce incorrect results on non-x86 architectures because: - MMIO requires specific accessor functions (writeq/readq) - Compiler optimizations may generate invalid instruction sequences - No guarantee of proper memory barriers or atomic access This patch converts CWSR buffer access to use struct iosys_map, which automatically handles both system memory (GTT) and MMIO (VRAM) correctly by: - Using writeq/writel/memcpy_toio for MMIO regions - Using WRITE_ONCE/memcpy for system memory - Providing proper memory barriers and access guarantees Changes: - Replace void *cwsr_kaddr with struct iosys_map cwsr_map - Detect MMIO vs system memory using TTM_BO_MAP_IOMEM_MASK - Use iosys_map_wr() for writing trap handler addresses and flags - Use iosys_map_memcpy_to() for copying CWSR ISA code This ensures correct operation on all architectures while maintaining backward compatibility with older GPUs and APUs that use GTT. Assisted-by: Claude:Claude-Opus-4.6 Signed-off-by: James Zhu <James.Zhu@amd.com> Acked-by: Christian König <christian.koenig@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/mes: Add NULL check for mes_hung_db_array allocationGeoffrey McRae1-4/+9
kcalloc but does not check for failure. If the allocation fails, the pointer remains NULL but the function returns success. Subsequent code using this buffer will dereference a NULL pointer, causing a kernel oops. Add a check to return -ENOMEM if the allocation fails. Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/jpeg: deduplicate jpeg_v5_3_0 process_interruptTiago Dourado3-21/+7
The jpeg_v5_3_0_process_interrupt function is identical to jpeg_v5_0_0_process_interrupt. Remove the duplicate implementation in jpeg_v5_3_0 and assign the jpeg_v5_0_0 version directly to the irq_funcs struct. Export jpeg_v5_0_0_process_interrupt through jpeg_v5_0_0.h to allow cross-version reuse. Signed-off-by: Tiago Dourado <tiagodourado@usp.br> Co-developed-by: Luiz Fernandes <luiz.f.f.fernandes@usp.br> Signed-off-by: Luiz Fernandes <luiz.f.f.fernandes@usp.br> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu/jpeg: deduplicate jpeg_v3_0 process_interruptTiago Dourado3-21/+6
The jpeg_v3_0_process_interrupt function is identical to jpeg_v2_0_process_interrupt. Remove the duplicate implementation in jpeg_v3_0 and assign the jpeg_v2_0 version directly to the irq_funcs struct. Export jpeg_v2_0_process_interrupt through jpeg_v2_0.h to allow cross-version reuse. Signed-off-by: Tiago Dourado <tiagodourado@usp.br> Co-developed-by: Luiz Fernandes <luiz.f.f.fernandes@usp.br> Signed-off-by: Luiz Fernandes <luiz.f.f.fernandes@usp.br> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amd/pm: retire legacy smu ras driver frameworkCe Sun7-50/+0
Remove the legacy smu ras driver framework Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy pmfw eeprom support checkCe Sun4-51/+2
Remove the legacy function to check pmfw eeprom support Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: Disable JDPG on VCN5_3Suresh Guttula1-2/+0
JDPG does not support on VCN5 This patch will disable JDPG, because DPG is not correctly copying the JRBC Read/Write Pointers (R/WPTR) from the PG (Power Gating) block to JRBC. Signed-off-by: Suresh Guttula <suresh.guttula@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: add support for SMU version 15.0.9Kanala Ramalingeswara Reddy5-1/+6
Initialize SMU Version 15_0_9 Signed-off-by: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com> Signed-off-by: Granthali Vinodkumar Dhandar <granthali.vinodkumardhandar@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: add support for PSP version 15.0.9Kanala Ramalingeswara Reddy2-1/+5
Initialize PSP Version 15_0_9 Signed-off-by: Kanala Ramalingeswara Reddy <Kanala.RamalingeswaraReddy@amd.com> Signed-off-by: Granthali Vinodkumar Dhandar <granthali.vinodkumardhandar@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdgpu: retire legacy pmfw eeprom interface wrapperCe Sun2-119/+0
retire legacy pmfw eeprom interface wrapper functions Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Ce Sun <cesun102@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08drm/amdkfd: drop duplicate kfd_queue_acquire_buffers()Alex Deucher1-6/+0
Duplicated code from the merge. Drop it. Fixes: 0461ba9a7994 ("Merge tag 'amd-drm-next-7.3-2026-07-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-next") Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-08gpu: nova-core: build SetRegistry entries dynamicallyZhi Wang2-34/+44
The GSP SetRegistry command currently stores its registry entries in a fixed-size array. That makes every additional runtime-dependent registry object require reshaping the command data structure at the same time as the feature that needs the new entry. Keep the existing registry contents unchanged, but store them in a KVec so SetRegistry can be constructed dynamically. The constructor now returns a Result to propagate allocation failures while the command payload layout is still computed from the final entry list. Cc: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Zhi Wang <zhiw@nvidia.com> Link: https://patch.msgid.link/20260701062622.3499033-7-zhiw@nvidia.com [acourbot: remove orphan comment.] Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-08gpu: nova-core: fsp: rename FSP response header typeZhi Wang1-8/+9
FSP message handling currently uses FspResponse for the common response prefix containing the MCTP header, NVDM header and command response payload. That name is too broad once other FSP response formats reuse the same prefix and append protocol-specific payloads. Rename it to FspResponseHeader so subsequent response structures can embed the common header without overloading the meaning of FspResponse. Suggested-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://lore.kernel.org/all/DJMBI9CN2Z67.2T02SR8TAWEC5@nvidia.com/ Signed-off-by: Zhi Wang <zhiw@nvidia.com> Link: https://patch.msgid.link/20260701062622.3499033-4-zhiw@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-08drm/v3d: bound CPU-job query writes to their destination BOMichael Bommarito1-0/+125
The V3D_SUBMIT_CPU CPU jobs take user-supplied offsets and indices and consume them at exec time without checking that the accesses stay inside their BO: - TIMESTAMP_QUERY and RESET_TIMESTAMP_QUERY write one u64 per query into bo[0] at a fully user-controlled per-query offset. - COPY_TIMESTAMP_QUERY copies one u64 per query into bo[0] at offset + i * stride, and reads each result from a user-controlled offset in the source bo[1]. - COPY_PERFORMANCE_QUERY writes nperfmons * DRM_V3D_MAX_PERF_COUNTERS counter slots plus an availability slot into bo[0] at the same geometry. - INDIRECT_CSD reads three u32 work-group counts from bo[0] at a user-controlled offset, then writes each count back into the indirect BO at a user-controlled u32 index (wg_uniform_offsets[]). A render-node user (DRM_RENDER_ALLOW, no master, no capability) can make the handlers read or write past a BO's vmap mapping. Validate the full access extent against the BO size once the BOs are looked up, before the job is queued, rejecting out-of-range geometry with -EINVAL. The copy extent offset + (count - 1) * stride + write_size is computed in u64, mirroring the u8 * pointer arithmetic in the executors: (count - 1) * stride is a u32 * u32 product that is exact in u64, so one overflow check on the total guards the bound. The performance slot count and the bare timestamp, copy-source and indirect offsets are computed in u64 the same way, so a user value cannot wrap the comparison. Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Fixes: 9ba0ff3e083f ("drm/v3d: Create a CPU job extension for the timestamp query job") Fixes: 34a101e64296 ("drm/v3d: Create a CPU job extension for the reset timestamp job") Fixes: 6745f3e44a20 ("drm/v3d: Create a CPU job extension to copy timestamp query to a buffer") Fixes: 209e8d2695ee ("drm/v3d: Create a CPU job extension for the copy performance query job") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Reviewed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com> Link: https://patch.msgid.link/20260707221334.3854433-1-michael.bommarito@gmail.com
2026-07-08drm/panel: Use drm_of_get_panel_orientation()Thierry Reding23-42/+41
The old of_drm_get_panel_orientation() function was replaced by the drm_of_get_panel_orientation() in the core DRM OF helpers. Replace all uses of the old helper and remove it. Changes in v5: - also convert r63419 panel Changes in v4: - also convert anbernic, chipone and ili9488 panels Changes in v2: - include drm_of.h in all drivers to make sure the new symbol is defined Signed-off-by: Thierry Reding <treding@nvidia.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260701121055.192475-4-tzimmermann@suse.de
2026-07-08drm/sysfb: simpledrm: Read panel orientation from DT nodeThomas Zimmermann1-2/+9
A device-tree panel node can specify the panel's rotation in steps of 90 degrees. Set the DRM connector orientation accordingly. Use UNKNOWN for the orientation if the field is missing or invalid. v3: - read the orientation with drm_of_get_panel_orientation() (Thierry) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260701121055.192475-3-tzimmermann@suse.de
2026-07-08drm/of: Implement drm_of_get_panel_orientation()Thomas Zimmermann2-24/+46
Implement drm_of_get_panel_orientation() to retrieve a panel's rotation property as enum drm_panel_orientation. The code has been taken from of_drm_get_panel_orientation(), so convert that helper over. Callers of the old helper can be converted as well. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260701121055.192475-2-tzimmermann@suse.de
2026-07-08Merge drm/drm-next into drm-misc-nextThomas Zimmermann639-24308/+39169
Backmerging to get updates from v7.2-rc2 into drm-misc-next. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2026-07-08drm/i915/display: Skip TRANS_VTOTAL.Vtotal write on NVL pre-C0Suraj Kandpal2-0/+15
On Nova Lake A/B steppings the GOP breaks DP-Alt / native DP output when TRANS_VTOTAL.Vtotal is programmed with a non-zero value, and the initial hardware readout of that field on such systems ends up in adjusted_mode.crtc_vtotal = 1 -- tripping the DSB scanline WARN in assert_dsl_ok() during intel_initial_commit. Keep TRANS_VTOTAL.Vtotal at 0 on Nova Lake pre-C0 (A0..B3) in both transcoder timing paths, and restore adjusted_mode.crtc_vtotal from TRANS_VRR_VMIN in intel_vrr_get_config() so downstream state stays consistent. Fixes: f26a8df8dff9 ("drm/i915/display: Program TRANS_VTOTAL from mode vtotal") Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260703032653.2122784-1-suraj.kandpal@intel.com
2026-07-08drm/i915/guc: Return NULL for missing multi-lrc parentLinmao Li1-1/+1
multi_lrc_create_parent() returns ERR_PTR(0) when there are not enough engines in the class to create a parallel context. ERR_PTR(0) evaluates to NULL, and the only caller already treats NULL as the non-error "not enough engines" case. Return NULL directly to make the non-error path explicit. Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260706071412.559909-1-lilinmao@kylinos.cn
2026-07-07drm/v3d: Reject invalid indirect BO handle in indirect CSD setupMaíra Canal1-0/+2
v3d_get_cpu_indirect_csd_params() looks up the indirect buffer object from a userspace-supplied handle but never checks the result. A bogus or stale handle makes drm_gem_object_lookup() return NULL, which is then stored in info->indirect and only dereferenced later when the indirect CSD job runs, turning a userspace mistake into a NULL pointer dereference in the kernel. Bail out with -ENOENT as soon as the lookup fails, so the bad handle is rejected at submission time. Fixes: 18b8413b25b7 ("drm/v3d: Create a CPU job extension for a indirect CSD job") Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com> Link: https://patch.msgid.link/20260703-v3d-cpu-job-fixes-v3-2-bc51b1f3eeb5@igalia.com
2026-07-07drm/v3d: Use write_to_buffer() helper in performance query copyMaíra Canal1-9/+2
The copy of performance query results to the output buffer open-codes the 32-bit/64-bit selection with two nearly identical loops. As the write_to_buffer() helper already encapsulates the do_64bit decision, use it instead of open-coding it. Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260703-v3d-cpu-job-fixes-v3-3-bc51b1f3eeb5@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-07-07drm/v3d: Serialize jobs across queues when a perfmon is attachedMaíra Canal4-6/+110
A non-global perfmon is meant to count events generated by a specific submission, but the scheduler can run jobs from different queues concurrently on the same V3D core. Without explicit serialization, an unrelated job running in parallel with a perfmon-carrying job pollutes the counters and generates unusable results. To address such issue, we must enforce cross-queue serialization when we detect a perfmon-carrying submission. It's possible to implement serialization by enforcing two rules: 1. A job that carries a non-global perfmon must wait for every job currently in-flight across all HW queues to finish. 2. While a perfmon-carrying job is still in-flight, all subsequently submitted jobs must wait for it. Note that serialization is not needed in the global perfmon case, as the global perfmon tracks activity from all jobs, so concurrency is desirable. Therefore, check if serialization is needed during job submission and if so, attach fence dependences to enforce cross-queue serialization. Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260706-v3d-perfmon-lifetime-v4-2-d7b312ff2c83@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
generated by cgit (git 2.54.0.dirty) at 2026-09-26 04:14:36 +0000