summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)AuthorFilesLines
2026-07-01drm/i915/display: Guard CMTG disable with intel_cmtg_is_allowed()Animesh Manna1-2/+3
intel_cmtg_disable() maps crtc_state->cpu_transcoder to a CMTG transcoder via to_cmtg_transcoder(), which only returns a valid transcoder for TRANSCODER_A/B. The disable call sites in hsw_crtc_disable() and the fastset/VRR path only check the sticky crtc->cmtg.enabled flag, so during a big-joiner reconfiguration that moves the eDP across pipes intel_cmtg_disable() can be reached with a crtc_state whose cpu_transcoder does not map to a CMTG transcoder. That results in a negative register-array index (trans_offsets[-1]) and a UBSAN array-index-out-of-bounds splat: UBSAN: array-index-out-of-bounds in .../display/intel_cmtg.c:187:24 intel_cmtg_disable+0x395/0x3d0 [xe] intel_old_crtc_state_disables+0xfb/0x1f0 [xe] intel_atomic_commit_tail+0xca6/0x2040 [xe] Gate both call sites with intel_cmtg_is_allowed() so that intel_cmtg_disable() is only invoked for configurations that actually map to a CMTG transcoder. v2: - Guard the intel_cmtg_disable() call sites with intel_cmtg_is_allowed() instead of a silent return (Suraj). Fixes: 3bb44e8d421a ("drm/i915/cmtg: Modify existing hook to disable CMTG") Signed-off-by: Animesh Manna <animesh.manna@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260629180236.1353704-2-animesh.manna@intel.com
2026-07-01drm/dp_mst: Handle torn-down topology gracefully in ↵Luca Coelho1-1/+3
drm_dp_mst_topology_queue_probe() A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check is already performed under mgr->lock, the condition is not a programming error but a valid race -- the topology was valid when the caller decided to call this function, but was torn down before the lock was acquired. Replace the drm_WARN_ON() with a graceful early return. This eliminates spurious kernel warnings and the resulting compositor crashes observed when connecting/disconnecting DP MST monitors, while keeping the correct behavior of doing nothing when MST is not active. A drm_dbg_mst() trace is added so the skipped probe remains observable under MST debug logging. The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst() already catches the case where the topology is initialized twice, so no diagnostic coverage is lost. Fixes: dbaeef363ea5 ("drm/dp_mst: Add a helper to queue a topology probe") Cc: Imre Deak <imre.deak@intel.com> Cc: Lyude Paul <lyude@redhat.com> Cc: stable@vger.kernel.org Cc: intel-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Jonas Emilsson <jonas.emilsson@gmail.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/all/20260503034533.1023686-1-jonas.emilsson@gmail.com Acked-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260622140532.526722-1-luciano.coelho@intel.com Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-07-01drm/xe/i2c: Drop manual VF checkRaag Jadav2-3/+1
Clear has_i2c flag inside vf_update_device_info() instead of manually checking for VF instance. Signed-off-by: Raag Jadav <raag.jadav@intel.com> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20260630091800.403926-1-raag.jadav@intel.com
2026-07-01drm/xe/pt: prevent invalid cursor access for purged BOsMatthew Auld1-5/+7
During a page table walk for binding, xe_pt_stage_bind() explicitly skips initializing the xe_res_cursor for purged BOs, treating them similarly to NULL VMAs by only setting the cursor size. However, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check if the BO was purged before attempting to walk the cursor using xe_res_dma() and xe_res_next(). Because the cursor was left uninitialized for purged BOs, this falls through and triggers warnings like: WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next Fix this by explicitly checking if the BO is purged in both xe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just as we do for NULL VMAs, avoiding the invalid cursor accesses entirely. As a precaution, also zero-initialize the cursor in xe_pt_stage_bind() to ensure we don't pass garbage data into the page table walkers if we ever hit a similar edge case in the future. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8418 Fixes: ad9843aac91a ("drm/xe/madvise: Implement purgeable buffer object support") Assisted-by: Copilot:gemini-3.1-pro-preview Reported-by: Matthew Schwartz <matthew.schwartz@linux.dev> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Arvind Yadav <arvind.yadav@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Link: https://patch.msgid.link/20260625152054.450125-8-matthew.auld@intel.com
2026-07-01drm/xe: account for dontneed in fdinfo purgeableMatthew Auld1-3/+2
Now that Xe supports explicit madvise WILLNEED/DONTNEED states, userspace can mark memory in any placement as eligible for purging. Update bo_meminfo to also include any BO explicitly marked as DONTNEED in the purgeable statistics, ensuring fdinfo accurately reflects all memory offered up for reclamation. v2 (Sashiko): - Also update the drm_print_memory_stats() so we don't mask out != SYSTEM Assisted-by: Copilot:gemini-3.1-pro-preview Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Arvind Yadav <arvind.yadav@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260625152054.450125-7-matthew.auld@intel.com
2026-07-01drm/xe: fix NPD in bo_meminfo()Matthew Auld1-1/+11
When a buffer object is purged, its ttm.resource is set to NULL via the TTM pipeline gutting flow. However, the BO remains in the client's object list until userspace explicitly closes the GEM handle. If memory stats are queried during this time, accessing bo->ttm.resource->mem_type will result in a NULL pointer dereference. Fix this by safely skipping purged BOs in bo_meminfo, as they no longer consume any memory. User is getting NPD on device resume, and possible theory is that in bo_move(), if we need to evict something to SYSTEM to save the CCS state, but the BO is marked as dontneed, this won't trigger a move but will nuke the pages, leaving us with a NULL bo resource. And the meminfo() doesn't look ready to handle a NULL resource. v2 (Sashiko): - There could potentially be other cases where we might end up with a NULL resource, so make this a general NULL check for now. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8419 Fixes: ad9843aac91a ("drm/xe/madvise: Implement purgeable buffer object support") Assisted-by: Copilot:gemini-3.1-pro-preview Reported-by: Matthew Schwartz <matthew.schwartz@linux.dev> Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Arvind Yadav <arvind.yadav@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Link: https://patch.msgid.link/20260625152054.450125-6-matthew.auld@intel.com
2026-07-01drm/i915/bios: range check LFP Data Block panel_type2Jani Nikula1-8/+28
While the panel_type from LFP Data Block is range checked, panel_type2 is not. Add a few helpers for range checking, and use them to not only check panel_type2, but also improve clarity and correctness in the panel type selection. Discovered using AI-assisted static analysis confirmed by Intel Product Security. v2: - Fix commit message typo (Michał) - Add is_panel_type_pnp() (Ville) Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT") Cc: stable@vger.kernel.org # v6.0+ Cc: Animesh Manna <animesh.manna@intel.com> Cc: Ville Syrjälä <ville.syrjala@intel.com> Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> # v1 Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260626140155.1389655-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit c9ebe5d2f25729d6cfbbb1235d640bf67f9275df) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-07-01drm/i915/vrr: require valid min/max vfreq for VRRJani Nikula1-0/+4
Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered (by coincidence) through the checks in intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit about it. At worst, a zero min_vfreq could lead to a division by zero in intel_vrr_compute_vmax(). Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 117cd09ba528 ("drm/i915/display/dp: Compute VRR state in atomic_check") Cc: stable@vger.kernel.org # v5.12+ Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260625131040.1051272-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-06-30drm/panel-edp: Add BOE NE160QDM-NY1 panelDamon Ding1-0/+1
Add an entry for the BOE NE160QDM-NY1 eDP panel. The panel's AUX backlight functionality is verified and working on the RK3576 EVB1 board. edid-decode (hex): 00 ff ff ff ff ff ff 00 09 e5 85 09 00 00 00 00 1c 1e 01 04 b5 22 15 78 03 7c e5 a4 55 4c 9f 26 0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 6b 6e 00 a0 a0 40 84 60 30 20 36 00 58 d7 10 00 00 1a 00 00 00 fd 0c 3c a5 1f 1f 4e 01 0a 20 20 20 20 20 20 00 00 00 fe 00 42 4f 45 20 43 51 0a 20 20 20 20 20 20 00 00 00 fe 00 4e 45 31 36 30 51 44 4d 2d 4e 59 31 0a 01 ed 02 03 1d 00 e3 05 80 00 e6 06 05 01 6a 6a 24 6d 1a 00 00 02 03 3c a5 00 04 6a 24 6a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff Signed-off-by: Damon Ding <damon.ding@rock-chips.com> Reviewed-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260625071916.744686-1-damon.ding@rock-chips.com
2026-06-30drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relaysMichal Wajdeczko1-4/+9
Currently defined VF/PF relay actions use regular REQUEST messages only and the PF shouldn't attempt to handle FAST_REQUEST nor EVENT messages as this would result in breaking the VFPF ABI protocol and also might trigger an assert on the PF side. Fixes: 98e62805921c ("drm/xe/pf: Add SR-IOV GuC Relay PF services") Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260527183735.22616-1-michal.wajdeczko@intel.com
2026-06-30drm/xe: Drop 'force_execlist' module parameterMatt Roper8-17/+2
During very early development of the Xe driver the force_execlist module parameter could be used to exercise some parts of the driver in a GuC-less manner. This was primarily intended to ensure that the driver was being designed and developed with proper modularity and layering; use of the GuC firmware has always been considered mandatory for any real Xe driver operation. The "execlist" implementation in the driver was never completed, and has further bitrotted over time to the point where it hangs during execution of even the simplest IGT tests like xe_exec_store now. Drop the force_execlist parameter; it's broken and isn't going to get fixed. In the (very unlikely) event that we decide to bring something like this back in the future, it would need to be as a per-device configfs setting rather than a driver-wide module parameter. The "execlist" implementation is now dead code, so it will probably also be removed sometime in the near future. There's a bit more general refactoring we might want to do first before we take that step, so for now we're just removing the module parameter. Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Link: https://patch.msgid.link/20260626-remove_execlists-v1-1-2584d8c4a6f2@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-06-30drm/xe/tests/rtp: Add kunit test for whitelist upper boundsMatt Roper3-1/+29
Xe must only add registers to the GT whitelist if they are listed in the "Software Allowlist" section of the bspec. These registers have been carefully reviewed by the architecture/security teams to ensure that they are safe to whitelist from a security perspective. The list of allowed registers changes from platform to platform, and it is not safe to assume that a register is safe to whitelist on a new platform/IP just because it was whitelisted on older ones. This means that whitelist entries in the driver that used undefined upper bounds (XE_RTP_END_VERSION_UNDEFINED) for their version ranges should always be considered illegal since they could potentially open unexpected security holes on future platforms. Add a kunit test to scan the whitelist RTP table and ensure that all entries have well-defined upper bounds on IP version ranges. Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com> Link: https://patch.msgid.link/20260626-kunit_whitelist_bounds-v3-1-aedf0b3adab9@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-06-30drm/panthor: Fix NPD issue on partial unmap of an evicted BOAkash Goel1-13/+13
This commit fixes the NULL pointer dereference issue that would have happened on the split of GPU mapping due to partial unmap of an evicted BO. There is a logic to handle the partial unmap of huge pages when the GPU mapping is split. That logic was not being completely skipped for the VMA of an evicted BO and that resulted in a NPD possibility for the 'bo->backing.pages' pointer, which is set to NULL when pages of a BO are released on eviction. Following dump was seen when a partial unmap was exercised for an evicted BO. Unable to handle kernel paging request at virtual address 0000000000002000 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000008842e8000 [0000000000002000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP <snip> pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : iova_mapped_as_huge_page+0x20/0x68 [panthor] lr : panthor_gpuva_sm_step_remap+0x39c/0x498 [panthor] sp : ffff800086193920 x29: ffff800086193920 x28: ffff800086193a18 x27: ffff800086193b80 x26: 0000000000400000 x25: 0000000000810000 x24: 0000000000400000 x23: ffff000808af1800 x22: 0000000000a00000 x21: ffff800086193a00 x20: ffff000806fd3f00 x19: 0000000000410000 x18: 00000000ffffffff x17: 0000000000000000 x16: 0000000000000000 x15: ffff800083ce2d83 x14: 0000000000000000 x13: 3120646574636976 x12: 6520303030303138 x11: 2d30303030313420 x10: ffff8000836e6c80 x9 : ffff80007bfc889c x8 : 3fffffffffffefff x7 : ffff8000836e6c80 x6 : 0000000000000000 x5 : ffff00097ef19088 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000010000 x1 : 0000000000000400 x0 : 0000000000000000 Call trace: iova_mapped_as_huge_page+0x20/0x68 [panthor] (P) op_remap_cb.isra.0+0x70/0xb0 __drm_gpuvm_sm_unmap+0xf8/0x1c0 drm_gpuvm_sm_unmap+0x40/0x60 panthor_vm_exec_op+0xa0/0x168 [panthor] panthor_vm_bind_exec_sync_op+0x8c/0xb8 [panthor] panthor_ioctl_vm_bind+0xbc/0x170 [panthor] drm_ioctl_kernel+0xc0/0x140 drm_ioctl+0x20c/0x500 __arm64_sys_ioctl+0xb4/0x118 invoke_syscall+0x5c/0x120 el0_svc_common.constprop.0+0x48/0xf8 do_el0_svc+0x28/0x40 el0_svc+0x38/0x128 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x198/0x1a0 Code: 8b030021 cb020021 f940b800 d34cfc21 (f8617801) ---[ end trace 0000000000000000 ]--- v2: Fix indentation Fixes: 8e7460eac786 ("drm/panthor: Support partial unmaps of huge pages") Signed-off-by: Akash Goel <akash.goel@arm.com> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Steven Price <steven.price@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260623130119.2737003-1-akash.goel@arm.com Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
2026-06-30drm/panthor: Keep interrupts masked until they are neededBoris Brezillon5-10/+18
The autogenerated panthor_request_xx_irq() helpers unmask Mali interrupts before we're sure we'll have a handler registered. For non-shared IRQ lines, that's fine, but for shared ones, it might cause an interrupt flood if the HW block raises an interrupt for any reason. We could reworking the calls in panthor_request_xx_irq(), but it's just simpler to let the caller decide when they are ready to handle interrupts and call panthor_pwr_irq_resume() themselves. While at it, rework the prototype to let users call panthor_pwr_irq_enable_events() explicitly instead of passing an initial mask to panthor_request_pwr_irq(). Fixes: 5fe909cae118 ("drm/panthor: Add the device logical block") Reported-by: Shashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260623-panthor-signal-from-irq-v3-0-2ece396f8ee0@collabora.com?part=3 Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Karunika Choo <karunika.choo@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260625-panthor-misc-fixes-v1-11-b67ed973fea6@collabora.com
2026-06-30drm/panthor: Interrupt group start/resumption if group_bind_locked() failsBoris Brezillon1-1/+7
group_bind_locked() can fail if the MMU block is stuck. This is normally a reset situation, but by the time we reset the GPU, we might have tried to resume a group that's not resident, which will probably trip out the FW. So let's avoid that by bailing out when group_bind_locked() returns an error. We don't even try to start more groups because the GPU will be reset anyway. Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260623-panthor-signal-from-irq-v3-0-2ece396f8ee0@collabora.com?part=7 Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260625-panthor-misc-fixes-v1-10-b67ed973fea6@collabora.com
2026-06-30drm/panthor: Fix a leak when a group is evicted before the tiler OOM is servicedBoris Brezillon1-1/+2
A group ref is tied to the pending tiler_oom_work, so we need to release it if the cancel was effective. Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260623-panthor-signal-from-irq-v3-0-2ece396f8ee0@collabora.com?part=7 Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260625-panthor-misc-fixes-v1-9-b67ed973fea6@collabora.com
2026-06-30drm/panthor: Drop a needless check in panthor_fw_unplug()Boris Brezillon1-3/+1
panthor_fw_unplug() is only called if we at least managed to initialize the IRQ, so it's safe to drop the "is IRQ initialized" check. Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260625-panthor-misc-fixes-v1-8-b67ed973fea6@collabora.com
2026-06-30drm/panthor: Fix panthor_pwr_unplug()Boris Brezillon1-1/+2
We can't call panthor_pwr_irq_suspend() if the device is suspended, or this leads to a hang when the IOMEM region is accessed while the clks are disabled. Do what other sub-components do and conditionally call panthor_pwr_irq_suspend() if we know the PWR regbank block is accessible. Fixes: c27787f2b77f ("drm/panthor: Introduce panthor_pwr API and power control framework") Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260625-panthor-misc-fixes-v1-7-b67ed973fea6@collabora.com
2026-06-30drm/panthor: Don't overrule pending immediate ticks in sched_resume_tick()Boris Brezillon1-1/+8
We schedule immediate ticks when we need to process events on CSGs, but those immediate ticks don't change the resched_target because we want the other groups to stay scheduled for the remaining of the GPU timeslot they were given. Make sure these immediate ticks don't get overruled by a sched_queue_delayed_work() that would delay the tick execution. Fixes: 99820b4b7e50 ("drm/panthor: Make sure we resume the tick when new jobs are submitted") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260625-panthor-signal-from-irq-v4-0-3d2908912afa@collabora.com?part=9 Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Karunika Choo <karunika.choo@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260625-panthor-misc-fixes-v1-6-b67ed973fea6@collabora.com
2026-06-30drm/panthor: Fix theoretical IOMEM access in suspended stateBoris Brezillon1-3/+7
In theory, our hardirq handler can be called while the device (and thus the panthor_irq) is suspended, because the IRQ line is shared. In practice though, in all the designs we've seen, the line is only shared within the GPU, and because sub-component suspend state is consistent (all-suspended or all-resumed), we shouldn't end up with an interrupt triggered while we're suspended. Fix the problem anyway, if nothing else, for our sanity. Fixes: 0b2d86670a84 ("drm/panthor: Rework panthor_irq::suspended into panthor_irq::state") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260625-panthor-signal-from-irq-v4-0-3d2908912afa@collabora.com?part=1 Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260625-panthor-misc-fixes-v1-5-b67ed973fea6@collabora.com
2026-06-30drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()Boris Brezillon1-1/+4
If heaps is an ERR_PTR(), panthor_heap_pool_put() will deref an invalid pointer. Make sure we set it to NULL in that case. Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260625-panthor-signal-from-irq-v5-0-8836a74e0ef9@collabora.com?part=2 Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260625-panthor-misc-fixes-v1-4-b67ed973fea6@collabora.com
2026-06-30drm/panthor: Keep the reset work disabled until everything is initializedBoris Brezillon1-0/+4
The reset work will sub-component reset helpers, which might not be ready if the reset happens during initialization, leading to NULL pointer dereferences or worse. Avoid that by keeping the reset work disabled while we're initializing those sub-components. Fixes: 5fe909cae118 ("drm/panthor: Add the device logical block") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260625-panthor-signal-from-irq-v5-0-8836a74e0ef9@collabora.com?part=4 Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260625-panthor-misc-fixes-v1-2-b67ed973fea6@collabora.com
2026-06-30drm/panthor: Always use the IRQ-safe variant when acquiring the fence lockBoris Brezillon1-43/+38
Since dma_fence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into account by also using the IRQ-safe variant when acquiring the lock. While at it, switch to the guard model. Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block") Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260625-panthor-signal-from-irq-v5-0-8836a74e0ef9@collabora.com?part=11 Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Signed-off-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260625-panthor-misc-fixes-v1-1-b67ed973fea6@collabora.com
2026-06-30drm/arm/komeda: fix error handling for clk_prepare_enable() and callersGustavo Kenji Mendonça Kaneko2-6/+14
komeda_dev_resume() calls clk_prepare_enable() without checking the return value. If the clock fails to enable, the function returns 0 (success) while IRQs are enabled and IOMMU is connected on potentially unclocked hardware, causing undefined behavior on resume. Propagate the error from clk_prepare_enable() and fix all call sites in komeda_drv.c that previously ignored the return value of komeda_dev_resume(): - komeda_platform_probe(): if resume fails, jump to err_destroy_mdev (skipping the suspend call, since the clock was never enabled) - komeda_pm_resume(): propagate the error and skip drm_mode_config_helper_resume() on failure This issue was found by code review without access to Komeda hardware. Signed-off-by: Gustavo Kenji Mendonça Kaneko <kaneko.dev@pm.me> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260609130828.1066038-1-kaneko.dev@pm.me Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
2026-06-30drm/arm/malidp: use clk_bulk API in runtime PM resume and suspendGustavo Kenji Mendonça Kaneko1-6/+16
malidp_runtime_pm_resume() calls clk_prepare_enable() three times without checking the return value. If any clock fails to enable, the driver silently proceeds with unclocked hardware, leading to undefined behavior. Convert both the resume and suspend paths to use the clk_bulk API: clk_bulk_prepare_enable() in resume checks the return value and rolls back any successfully enabled clocks on failure; clk_bulk_disable_unprepare() in suspend keeps the two paths symmetric. This issue was found by code review without access to Mali DP hardware. Signed-off-by: Gustavo Kenji Mendonça Kaneko <kaneko.dev@pm.me> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260609130812.1065699-1-kaneko.dev@pm.me Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
2026-06-30gpu: nova-core: vbios: parse structs via zerocopyNicolás Antinori2-50/+20
Replace the unsafe `kernel::transmute::FromBytes` trait implementation for the `FalconUCodeDescV3`, `PcirStruct`, `BitHeader`, `BitToken`, `NpdeStruct`, `PciRomHeader`, `PmuLookupTableEntry` and `PmuLookupTableHeader` structs with the derivable `zerocopy::FromBytes` trait. This change eliminates the manual unsafe implementations in favor of a derivable trait. When this trait is derived, validity checks are performed at compile time to ensure that the type can safely implement `FromBytes`. Suggested-by: Miguel Ojeda <ojeda@kernel.org> Link: https://github.com/Rust-for-Linux/linux/issues/1241 Signed-off-by: Nicolás Antinori <nico.antinori.7@gmail.com> Link: https://patch.msgid.link/20260629142007.269873-1-nico.antinori.7@gmail.com [acourbot: add `vbios:` prefix to commit title.] Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-06-30drm/virtio: fail init on display-info timeoutPengpeng Hou1-4/+10
virtio_gpu_init() sends GET_DISPLAY_INFO when scanouts are present and waits for display_info_pending to clear. If the response never arrives, the wait result is ignored and probe still succeeds. Return -ETIMEDOUT on display-info timeout. Because this happens after virtio_device_ready(), reset the device and tear down modesetting before using the existing vbuf and virtqueue cleanup path. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Link: https://patchwork.freedesktop.org/patch/735301/ [dmitry.osipenko@collabora.com: rebase on misc-next]
2026-06-30drm/virtio: bound EDID block reads to the response bufferBryam Vargas1-1/+2
virtio_get_edid_block() validates the read offset only against the device-supplied resp->size field, never against the fixed-size resp->edid array. The EDID block index is driven by the device-supplied extension count, so a malicious virtio-gpu backend can advertise a large size together with a high block count and read far past the array into adjacent kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds read / info leak). Also reject any read whose end exceeds the size of the edid array. Conforming EDID responses stay within the array and are unaffected. Fixes: b4b01b4995fb ("drm/virtio: add edid support") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Link: https://patch.msgid.link/20260620-b4-disp-22bba7bf-v1-1-b95924cee742@proton.me
2026-06-30Merge drm/drm-next into drm-intel-nextJani Nikula861-10977/+125280
Sync with v7.2-rc1. Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-06-30drm/sysfb: simpledrm: Validate mmap size against framebuffer sizeThomas Zimmermann1-0/+24
The size of the mmap'ed framebuffer could be smaller than the minimum required framebuffer size. Validate the resource size against the framebuffer size. Buggy firmware that triggers this check should be fixed up with a quirk on a case-by-case base. v3: - fix size checks (Sashiko) - improve error message for alignment check (Thierry) - do not store aligned size value Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Suggested-by: Sashiko <sashiko-bot@kernel.org> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260625094509.157581-6-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Improve stride validationThomas Zimmermann1-2/+8
Validate the computed stride against the maximum value INT_MAX. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Fixes: 7bfa5c7b28d6 ("drm/simpledrm: Compute linestride with drm_format_info_min_pitch()") Cc: <stable@vger.kernel.org> # v6.1+ Link: https://patch.msgid.link/20260625094509.157581-5-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Inline simplefb_get_validated_int()Thomas Zimmermann1-9/+2
The helper simplefb_get_validated_int() is only a wrapper around drm_sysfb_get_validated_int(). Inline the function into its callers. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260625094509.157581-4-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Improve panel-size validationThomas Zimmermann1-3/+46
Validate the panel size from the device-tree node against the limitations of struct drm_display_mode. The type only stores sizes in 16-bit fields. Fail transparently on errors; do not warn. v3: - move comments to a more prominent place (Thierry) v2: - only use initialized values in debugging output (Sashiko) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Fixes: 2a6d731a8f16 ("drm/simpledrm: Allow physical width and height configuration via panel node") Cc: Rayyan Ansari <rayyan@ansari.sh> Cc: <stable@vger.kernel.org> # v6.4+ Link: https://patch.msgid.link/20260625094509.157581-3-tzimmermann@suse.de
2026-06-30drm/sysfb: simpledrm: Improve framebuffer-size validationThomas Zimmermann1-11/+4
Validate the framebuffer size from the firmware against the limitations of struct drm_display_mode. The type only stores sizes in 16-bit fields. Fail probing on errors. v2: - remove unused function simplefb_get_validated_int0() (Sashiko) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Thierry Reding <treding@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") Cc: <stable@vger.kernel.org> # v5.14+ Fixes: 11e8f5fd223b ("drm: Add simpledrm driver") Link: https://patch.msgid.link/20260625094509.157581-2-tzimmermann@suse.de
2026-06-30firmware: sysfb: Mark CONFIG_SYSFB_SIMPLEFB as deprecatedThomas Zimmermann1-5/+2
Mark CONFIG_SYSFB_SIMPLEFB as deprecated. Enabling it allows to run simpledrm and simplefb on EFI/VESA framebuffers. Doing this is discouraged in favor of using efidrm and vesadrm. v2: - resolve conflicting help texts (Sashiko) Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260625065724.15794-1-tzimmermann@suse.de
2026-06-30drm/i915/bios: range check LFP Data Block panel_type2Jani Nikula1-8/+28
While the panel_type from LFP Data Block is range checked, panel_type2 is not. Add a few helpers for range checking, and use them to not only check panel_type2, but also improve clarity and correctness in the panel type selection. Discovered using AI-assisted static analysis confirmed by Intel Product Security. v2: - Fix commit message typo (Michał) - Add is_panel_type_pnp() (Ville) Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 6434cf630086 ("drm/i915/bios: calculate panel type as per child device index in VBT") Cc: stable@vger.kernel.org # v6.0+ Cc: Animesh Manna <animesh.manna@intel.com> Cc: Ville Syrjälä <ville.syrjala@intel.com> Reviewed-by: Michał Grzelak <michal.grzelak@intel.com> # v1 Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260626140155.1389655-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-06-30Merge drm/drm-next into drm-misc-nextThomas Zimmermann703-8114/+121201
Backmerging to get drm-misc-next to v7.2-rc1. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2026-06-30drm/i915/vrr: require valid min/max vfreq for VRRJani Nikula1-0/+4
Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered (by coincidence) through the checks in intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit about it. At worst, a zero min_vfreq could lead to a division by zero in intel_vrr_compute_vmax(). Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: 117cd09ba528 ("drm/i915/display/dp: Compute VRR state in atomic_check") Cc: stable@vger.kernel.org # v5.12+ Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260625131040.1051272-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-06-30drm/i915/hdcp: require monotonically increasing seq_num_vJani Nikula1-3/+4
The HDCP 2.2 specification requires the seq_num_v to be monotonically increasing, and repeated seq_num_v needs to be treated as an integrity failure. Make it so. For the first message, seq_num_v must be zero, and is already checked. We can only check for less-than-or-equal for the subsequent messages, where hdcp2_encrypted is true. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: d849178e2c9e ("drm/i915: Implement HDCP2.2 repeater authentication") Cc: stable@vger.kernel.org # v5.2+ Cc: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260625104407.1025614-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit 58a224375c81179b52558c53d8857b93196d2687) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-06-30drm/i915/hdcp: check streams[] bounds before overflowJani Nikula1-1/+4
The data->streams[] overflow check is done after the buffer overflow has already happened. Move the overflow check before the write. Side note, emitting a warning splat with a backtrace might be overkill here, but prefer not changing the behaviour other than not doing the overrun. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: e03187e12cae ("drm/i915/hdcp: MST streams support in hdcp port_data") Cc: stable@vger.kernel.org # v5.12+ Cc: Anshuman Gupta <anshuman.gupta@intel.com> Cc: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260625170304.1104723-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-06-30drm/i915: Return NULL on error in active_instanceJoonas Lahtinen1-1/+6
Avoid returning &node->base when node is NULL due to OOM during GFP_ATOMIC allocation. Discovered using AI-assisted static analysis confirmed by Intel Product Security. Reported-by: Martin Hodo <martin.hodo@intel.com> Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.") Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Simona Vetter <simona.vetter@ffwll.ch> Cc: <stable@vger.kernel.org> # v5.13+ Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Reviewed-by: Sebastian Brzezinka <sebastian.brzezinka@intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com (cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832) Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2026-06-30drm/lima: call drm_mm_init() with a valid allocation rangeHenrik Grimler1-6/+6
lima_vm_create() is currently run before va_start and va_end are set up, meaning they are both 0. lima_vm_create() runs drm_mm_init() with them as arguments for the allocator, and if DRM_DEBUG_MM is enabled the DRM_MM_BUG_ON check in drm_mm_init then fires, as seen here on exynos4412-odroid-u2: [ 1.736297] ------------[ cut here ]------------ [ 1.740370] kernel BUG at drivers/gpu/drm/drm_mm.c:931! [ 1.745574] Internal error: Oops - BUG: 0 [#1] SMP ARM [ 1.750697] Modules linked in: [ 1.753734] CPU: 0 UID: 0 PID: 41 Comm: kworker/u16:1 Not tainted 7.0.10-postmarketos-exynos4 #11 PREEMPT [ 1.763372] Hardware name: Samsung Exynos (Flattened Device Tree) [ 1.769446] Workqueue: events_unbound deferred_probe_work_func [ 1.775261] PC is at drm_mm_init+0x9c/0xa4 [ 1.779339] LR is at lima_vm_create+0x144/0x17c [ ... ] Fix the issue by moving the lima_vm_create() call after va_start and va_end are set up. Fixes: a1d2a6339961 ("drm/lima: driver for ARM Mali4xx GPUs") Signed-off-by: Henrik Grimler <henrik.grimler@axis.com> Signed-off-by: Qiang Yu <yuq825@gmail.com> Link: https://patch.msgid.link/20260601-lima-alloc-fix-v1-1-16d3f3b7b780@axis.com
2026-06-30ttm/pool: Use sentinels in debugfsMario Limonciello1-3/+10
The values in the `page_pool_shrink` debugfs file should recognize the sentinels rather than causing an underflow. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5218 Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Link: https://patch.msgid.link/20260427162253.682415-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello <superm1@kernel.org>
2026-06-29drm/amd/display: use DisplayID panel type in dm_set_panel_typeChenyu Chen1-5/+11
Wire up the newly parsed panel_type from drm_display_info into amdgpu_dm's panel type detection path. When neither the AMD VSDB nor DPCD determines the panel type, fall back to the DisplayID Display Device Technology field to set PANEL_TYPE_LCD or PANEL_TYPE_OLED accordingly. Also expose LCD to userspace via the panel_type connector property. Assisted-by: Copilot:Claude-Opus-4.6 Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260526030254.1460480-4-chen-yu.chen@amd.com Signed-off-by: Mario Limonciello <superm1@kernel.org>
2026-06-29drm/edid: parse panel type from DisplayID 2.x Display ParametersChenyu Chen3-1/+71
Parse the Display Parameters Data Block (tag 0x21) defined in DisplayID v2.1a Section 4.2.6. Extract the Display Device Technology field from the color depth and device technology byte, which indicates whether the panel uses LCD or OLED technology. Add a panel_type field to struct drm_display_info and populate it during DisplayID iteration so downstream drivers can use it for panel-type-dependent behavior. Add DRM_MODE_PANEL_TYPE_LCD to the UAPI panel type property alongside the existing OLED value. Assisted-by: Copilot:Claude-Opus-4.6 Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260526030254.1460480-3-chen-yu.chen@amd.com Signed-off-by: Mario Limonciello <superm1@kernel.org>
2026-06-29drm/edid: extract base section header processing into helperChenyu Chen1-16/+21
Extract the DisplayID base section header logging and non_desktop detection from update_displayid_info() into a dedicated helper, drm_displayid_process_base_section_header(). Remove the break so the iterator walks through all data blocks, preparing for future patches that will parse additional block types within the loop. The helper is called only once for the base section via a base_section_header_processed flag. Since version and primary_use are only captured from the base section, and extension sections carry a primary use of zero per spec, the non_desktop logic is unaffected. No functional change. Assisted-by: Copilot:Claude-Opus-4.6 Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260526030254.1460480-2-chen-yu.chen@amd.com Signed-off-by: Mario Limonciello <superm1@kernel.org>
2026-06-29drm/xe/hw_engine: Fix double-free of managed BO in error pathShuicheng Lin1-3/+1
The error path in hw_engine_init() explicitly frees a BO allocated with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure. Remove the explicit free and let devm handle it, consistent with all other xe_managed_bo_create_pin_map() callers. Fixes: 0e1a47fcabc8 ("drm/xe: Add a helper for DRM device-lifetime BO create") Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Zongyao Bai <zongyao.bai@intel.com> Link: https://patch.msgid.link/20260626210631.3887291-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-06-29drm/xe/userptr: Drop bogus static from finish in force_invalidateShuicheng Lin1-1/+1
The local "finish" pointer in xe_vma_userptr_force_invalidate() is unconditionally written before each read, so the static storage class serves no purpose. Worse, it makes the variable a process-wide shared slot: the function's per-VM asserts do not exclude concurrent callers on different VMs, so two such callers can race on the slot and take the wrong if (finish) branch. The function is gated by CONFIG_DRM_XE_USERPTR_INVAL_INJECT (developer/test option, default n), so production builds are unaffected. Drop the static. Fixes: 18c4e536959e ("drm/xe/userptr: Convert invalidation to two-pass MMU notifier") Assisted-by: Claude:claude-opus-4.7 Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Zongyao Bai <zongyao.bai@intel.com> Link: https://patch.msgid.link/20260625224452.3243231-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-06-29drm/xe/userptr: Hold notifier_lock for write on inject test pathShuicheng Lin2-10/+48
When CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y, xe_pt_svm_userptr_pre_commit() runs vma_check_userptr() with the svm notifier_lock taken for read. The test injection causes vma_check_userptr() to call xe_vma_userptr_force_invalidate(), which feeds into xe_vma_userptr_do_inval() with drm_gpusvm_ctx.in_notifier=true. That flag tells drm_gpusvm_unmap_pages() the caller already holds notifier_lock for write and only asserts the mode. Because the caller actually holds it for read, the assertion fires: WARNING: drivers/gpu/drm/drm_gpusvm.c:1669 at \ drm_gpusvm_unmap_pages+0xd4/0x130 [drm_gpusvm_helper] Call Trace: xe_vma_userptr_do_inval+0x40d/0xfd0 [xe] xe_vma_userptr_invalidate_pass1+0x3e6/0x8d0 [xe] xe_vma_userptr_force_invalidate+0xde/0x290 [xe] vma_check_userptr.constprop.0+0x1c6/0x220 [xe] xe_pt_svm_userptr_pre_commit+0x6a3/0xc60 [xe] ... xe_vm_bind_ioctl+0x3a0a/0x4480 [xe] Acquire notifier_lock for write in pre-commit when the inject Kconfig is enabled, via new helpers xe_pt_svm_userptr_notifier_lock()/_unlock(). Rename xe_svm_assert_held_read() to xe_svm_assert_held_read_or_inject_write() so it asserts the correct mode under each build configuration. Production builds (CONFIG_DRM_XE_USERPTR_INVAL_INJECT=n) keep the existing read-mode behavior bit-for-bit. Fixes: 9e9787414882 ("drm/xe/userptr: replace xe_hmm with gpusvm") Assisted-by: Claude:claude-opus-4.7 Cc: Matthew Auld <matthew.auld@intel.com> Cc: Zongyao Bai <zongyao.bai@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260625215615.3016892-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-06-29gpu: nova-core: falcon: store bar and dev in falconTim Kovalenko17-316/+263
Store the bound device and `BAR0` mapping in `Falcon` instead of passing them through every `Falcon` operation. This simplifies the `Falcon` API and removes repeated `dev`/`bar` plumbing from reset, load, boot, mailbox, DMA, and GSP/FSP-specific Falcon helpers. `FalconHal` now receives a reference to a `Falcon` and uses its methods and members instead of passing them individually. Suggested-by: Alexandre Courbot <acourbot@nvidia.com> Link: https://rust-for-linux.zulipchat.com/#narrow/channel/509436-Nova/topic/Storing.20driver-bound.20references.20into.20sub-devices/near/599137882 Signed-off-by: Tim Kovalenko <tim.kovalenko@proton.me> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260625-drm-bar-refactor-v2-1-9db6b890d92e@proton.me Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
generated by cgit (git 2.54.0.dirty) at 2026-09-26 17:07:52 +0000