summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)AuthorFilesLines
2026-07-01drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userqJesse Zhang1-14/+29
Try KQ by ring_id first (KCQ and UQ never share a HW slot); fall back to amdgpu_userq_process_fence_irq() on miss, since KCQ EOPs were misrouted into the userq fence path when enable_mes is true. Require a strict (me,pipe,queue) match in the gfx case, then userq gfx EOPs fall through to amdgpu_userq_process_fence_irq(). Suggested-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 6c1f4f7ff08448e0e18cd7fc4e59d6c96a36f25d) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userqJesse Zhang1-14/+29
Try KQ by ring_id first (KCQ and UQ never share a HW slot); fall back to amdgpu_userq_process_fence_irq() on miss, since KQ EOPs were misrouted into the userq fence path when enable_mes is true. Require a strict (me,pipe,queue) match in the gfx case, then userq gfx EOPs fall through to amdgpu_userq_process_fence_irq(). Suggested-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 88e589cc811ba907209a426c426c469bcb4bb894) Cc: stable@vger.kernel.org
2026-07-01drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO sizeYongqiang Sun2-3/+23
CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the HW field is larger than the queue's control stack allocation, memcpy reads past the BO into adjacent GTT memory and can leak kernel data to userspace. Store the page-aligned control stack BO size in mqd_manager and clamp checkpoint copies and reported checkpoint sizes to min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound for multi-XCC v9.4.3 checkpoint layout. Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com> Reviewed-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu: fix aperture mapping leakAsad Kamal2-22/+16
amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to always return false, so iounmap(aper_base_kaddr) never runs on normal driver unload, leaving an orphaned entry in the x86 PAT interval tree. On connected_to_cpu hardware, the aperture is mapped write-back (WB) via ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC) over the same range. The WC vs WB conflict causes: ioremap error for 0x..., requested 0x1, got 0x0 amdgpu: discovery failed: -2 Fix by switching to devres-managed mappings so cleanup is guaranteed regardless of drm_dev_enter() state: - connected_to_cpu path: devm_memremap(MEMREMAP_WB). For IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut, returning __va(offset) from the existing kernel direct map. No new ioremap VA or PAT entry is created, so there is nothing to orphan. - dGPU path: devm_ioremap_wc() registers iounmap() as a devres action, guaranteeing cleanup at device_del() time. Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio() since the mapping is now devres-owned. v2: Remove redundant x86_64 guard (Lijo) Fixes: 9d0af8b4def0 ("drm/amdgpu: pre-map device buffer as cached for A+A config") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a) Cc: stable@vger.kernel.org
2026-07-01drm/amd/display: avoid large stack allocation in ↵Arnd Bergmann1-5/+5
commit_planes_do_stream_update_sequence The function has two arrays on the stack to hold temporary dsc_optc_config and dsc_config objects. The combination blows through common stack frame warning limits in combination with the other local variables: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4070:22: error: stack frame size (1352) exceeds limit (1280) in 'commit_planes_do_stream_update_sequence' [-Werror,-Wframe-larger-than] Since neither array is initialized or used outside of the add_link_update_dsc_config_sequence() function, there is no actual need to keep each element around. Replace the arrays with a single instance each to reduce the stack usage to less than half. Fixes: 9f49d3cd7e71 ("drm/amd/display: Implement block sequencing infrastructure for modular hardware operations.") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 9e0896fa6f7dbe9ca3dbbd3b593fa91670f4820b) Cc: stable@vger.kernel.org
2026-07-01drm/amd/display: Remove DCCG registers not needed in DCN42Matthew Stewart1-32/+30
[why] Some resources that exist in the DCN block are not needed and shouldn't be used. [how] Remove defines from register lists. Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com> Signed-off-by: Matthew Stewart <Matthew.Stewart2@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit dac8aa629a45e34027444f74d3b86b6f104b024c)
2026-07-01drm/amd/display: Fix DCN42 null registers & register masksMatthew Stewart1-2/+2
[why] The register lists used on DCN42 variants are different. Some reused codepaths are trying to access registers not used. [how] Add DISPCLK_FREQ_CHANGECNTL, HUBPREQ_DEBUG, and HDMISTREAMCLK_CNTL to the register lists. Reviewed-by: Ovidiu (Ovi) Bunea <ovidiu.bunea@amd.com> Signed-off-by: Matthew Stewart <Matthew.Stewart2@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 64142f9d51aff32f4130d916cb8f044a072ad27d)
2026-07-01drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_sizeXiaogang Chen5-10/+10
To avoid wraparound if the value is 0. Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit c0cae35661868af207077a4306bc42c7c972947c) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/vce: fix integer overflow in image sizeBoyuan Zhang1-3/+14
Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32-bit integer overflow, wrapping the calculated buffer size to 0. This bypasses validation and allows GPU firmware to perform out-of-bound memory access. The fix uses 64-bit arithmetic to detect overflow and rejects invalid dimensions before they reach the hardware. V2: remove redundant check V3: modify max height value V4: remove size64 Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/vcn4: avoid rereading IB param lengthBoyuan Zhang1-6/+9
Reuse the parameter length returned by vcn_v4_0_enc_find_ib_param() instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com> Reviewed-by: David Rosca <david.rosca@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu: fix division by zero with invalid uvd dimensionsBoyuan Zhang1-0/+8
When width or height is less than 16, width_in_mb or height_in_mb becomes 0, leading to fs_in_mb being 0. This causes a division by zero when calculating num_dpb_buffer in H264 and H264 Perf decode paths. Add validation to reject frames with width < 16 or height < 16 before performing any calculations that depend on these values. V2: Format change - move up all vaiable definitions. V3: Use warn_once to avoid spam. Signed-off-by: Boyuan Zhang <boyuan.zhang@amd.com> Reviewed-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 3e41d26c70b0a459d041cc19482a226c4b7423cb) Cc: stable@vger.kernel.org
2026-07-01drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.xLeorize2-2/+16
When BT.2020 colorimetry is selected, the driver sends information using VSC SDP but does not set "ignore MSA colorimetry" bit on older GPUs with DCE-based IPs. This causes certain sinks to prefer colorimetry information in DP MSA, resulting in terrible color rendering ("dull" colors) when HDR is enabled. This commit wires up the MISC1 bit 6 for GPUs with DCE 11.x based IPs to correctly configure sinks to ignore colorimetry information in MSA, resolving the color rendering issue. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4849 Assisted-by: oh-my-pi:GPT-5.5 Signed-off-by: Leorize <leorize+oss@disroot.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 323a09e56c1d549ce47d4f110de77b0051b4a8bf) Cc: stable@vger.kernel.org
2026-07-01drm/amd/pm: fix amdgpu_pm_info power display unitsYang Wang1-9/+12
amdgpu_pm_info displayed power sensor readings with the wrong fractional unit. It treated the low byte of the raw sensor value as the decimal part of watts, while that field represents milliwatts in the decoded value. As a result, debugfs could report misleading SoC power when the remainder was not already a two-digit centiwatt value. Example with query = 0x00000354: raw field value --------------------- query >> 8 3 W query & 0xff 84 mW decoded power 3084 mW output value --------------------- before 3.84 W after 3.08 W Fixes: f0b8f65b4825 ("drm/amd/amdgpu: fix the GPU power print error in pm info") Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 01992b121fb652c753d37e0c1427a2d1a557d2b1) Cc: stable@vger.kernel.org
2026-07-01drm/amd/pm: make pp_features read-only when scpm is enabledYang Wang1-0/+5
SCPM owns power feature control when enabled. Make pp_features read-only during sysfs setup by clearing its write bits and store callback. Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 6a5786e191fdce36c5db170e5209cf609e8f0087) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()Alex Deucher1-2/+2
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()Alex Deucher1-2/+2
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 9723a8bed3aa251a26bee4583bac9d8fb064dd44) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()Alex Deucher1-2/+2
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()Alex Deucher1-2/+2
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ae658afc7f47f6147371ec42cc6b1a793dfdb5af) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()Alex Deucher1-2/+2
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()Alex Deucher1-2/+2
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit fa4f86a148271e325e95287630a3a15a9cd35fdc) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()Alex Deucher1-7/+4
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit e4d99e04b2e9b13b97d3b17804c735f62689db23) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()Alex Deucher1-8/+5
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f952076f76d62f783e8ba4995a7c400d39354ccf) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()Alex Deucher1-8/+5
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()Alex Deucher1-8/+5
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()Alex Deucher1-7/+4
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 5676593d08998d7a6d9e2d51d6b54b3820e3755c) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()Alex Deucher1-5/+5
There's no need to crash the kernel for these cases. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/gfx8: drop unecessary BUG_ON()Alex Deucher1-3/+0
There's no need to crash the kernel for this case. Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891) Cc: stable@vger.kernel.org
2026-07-01drm/amdgpu/soc24: reset dGPU if suspend got abortedJakob Linke1-0/+28
For SOC24 ASICs (RDNA4 / Navi 4x dGPUs) re-enabling PM features fails if an S3 suspend got aborted, the same issue already handled for SOC21 and SOC15: commit df3c7dc5c58b ("drm/amdgpu: Reset dGPU if suspend got aborted") commit 38e8ca3e4b6d ("amdgpu/soc15: enable asic reset for dGPU in case of suspend abort") The aborted resume fails with: amdgpu: SMU: No response msg_reg: 6 resp_reg: 0 amdgpu: Failed to enable requested dpm features! amdgpu: resume of IP block <smu> failed -62 Apply the same workaround for soc24: detect the aborted-suspend state at resume via the sign-of-life register and reset the device before re-init. This is a workaround till a proper solution is finalized. Fixes: 98b912c50e44 ("drm/amdgpu: Add soc24 common ip block (v2)") Signed-off-by: Jakob Linke <jakob@linke.cx> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit fed5bdbfe1d4a19a26c70f7fc58017dc88be1c18) Cc: stable@vger.kernel.org
2026-07-01drm/panel-edp: Support MB116AS01'3 edp panelHaikun Zhou1-0/+1
MB116AS01'3 raw edid: 00 ff ff ff ff ff ff 00 21 63 03 12 00 00 00 00 00 23 01 04 95 1a 0e 78 23 e7 05 9c 5b 56 93 27 21 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 36 1c 56 92 50 00 1c 30 60 18 a8 00 00 90 10 00 00 18 00 00 00 fd 00 28 3c 30 30 07 01 0a 20 20 20 20 20 20 00 00 00 fe 00 48 4b 43 20 4d 59 20 20 20 20 0a 20 20 00 00 00 fe 00 4d 42 31 31 36 41 53 30 31 27 33 20 20 01 cb 70 20 79 02 00 22 00 14 1c 1a 01 84 55 05 91 00 5f 00 17 00 ff 02 1b 00 09 00 07 00 2b 00 06 27 00 28 3b 00 00 81 00 13 72 1a 00 00 03 01 28 3c 00 00 00 00 00 00 3c 00 00 00 00 25 01 09 1c 1a 01 1c 1a 01 28 3c 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e7 90 Signed-off-by: Haikun Zhou <zhouhaikun5@huaqin.corp-partner.google.com> Reviewed-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260701013018.2621972-1-zhouhaikun5@huaqin.corp-partner.google.com
2026-07-01drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRGAshutosh Dixit1-1/+1
'head' argument for WHITELIST_OA_MERT_MMIO_TRG was previously wrong (not multiple of 16). Fix this. Fixes: ec02e49f21bc ("drm/xe/rtp: Whitelist OAMERT MMIO trigger registers") Cc: stable@vger.kernel.org Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Link: https://patch.msgid.link/20260629172634.1100983-1-ashutosh.dixit@intel.com
2026-07-01drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelistsAshutosh Dixit1-3/+5
Unconditionally whitelisting OA registers is a security violation. Set RING_FORCE_TO_NONPRIV_DENY bit in OA nonpriv slots, so that OA registers don't get whitelisted by default after probe, gt reset, resume and engine reset. Fixes: 828a8eaf37c3 ("drm/xe/oa: Add MMIO trigger support") Cc: stable@vger.kernel.org # v6.12+ Suggested-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Link: https://patch.msgid.link/20260615224227.34880-2-ashutosh.dixit@intel.com (cherry picked from commit 90511bdcfda97211c01f1d945d4ea616578d8fca) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-07-01drm/xe: Remove redundant exec_queue_suspended() check in submit_exec_queue()Lu Yao1-1/+1
There already has a check for exec_queue_suspended(q) that returns early if suspended. Fixes: 65280af331aa ("drm/xe/multi_queue: skip submit when primary queue is suspended") Signed-off-by: Lu Yao <yaolu@kylinos.cn> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260617012516.19930-1-yaolu@kylinos.cn Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> (cherry picked from commit 173202a5a3a9e6590194ce0f5880d1529a71ade7) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-07-01drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry()Francois Dugast1-2/+10
The page-table walk framework may pass a NULL *child pointer for unpopulated entries. xe_pt_zap_ptes_entry() called container_of(*child) before checking for NULL, then dereferenced the result, causing a crash. Move the container_of() call after a NULL guard, so the function returns early instead of proceeding with an invalid pointer. XE_WARN_ON is kept to help root cause the issue, but we now bail instead of crashing the driver. v2: Comment that triggering XE_WARN_ON is unexpected behavior (Matt Brost) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Matthew Brost <matthew.brost@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://lore.kernel.org/r/20260616081756.286918-1-francois.dugast@intel.com Signed-off-by: Francois Dugast <francois.dugast@intel.com> (cherry picked from commit b9297d19d9df5d4b6c994648570c5dcd1cac68ff) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-07-01drm/xe: wedge from the timeout handler only after releasing the queueRodrigo Vivi1-2/+5
A kernel job that exhausts its recovery attempts called xe_device_declare_wedged() directly from guc_exec_queue_timedout_job(), while the handler still owned the timed-out job and the queue scheduler (sched = &q->guc->sched, stopped at the top of the handler). In the default wedged mode (XE_WEDGED_MODE_UPON_CRITICAL_ERROR), xe_device_declare_wedged() takes the destructive path in xe_guc_submit_wedge(): guc_submit_reset_prepare(), xe_guc_submit_stop() - which calls guc_exec_queue_stop() on every queue, including this one - softreset and pause-abort. That tears submission down, signals the in-flight fences and restarts the schedulers. This is the correct behaviour when the wedge originates outside the TDR, but not when the TDR itself triggers it: every queue should be torn down except the one the TDR is currently operating on, which it still owns. Control then returned to the handler, which kept using the now stale job and scheduler: xe_sched_job_set_error(job, err); drm_sched_for_each_pending_job(tmp_job, &sched->base, NULL) xe_sched_job_set_error(to_xe_sched_job(tmp_job), -ECANCELED); drm_sched_for_each_pending_job() warns because the scheduler is no longer stopped (WARN_ON(!drm_sched_is_stopped())) and the iteration then dereferences a freed job, faulting on the slab poison: Oops: general protection fault ... 0x6b6b6b6b6b6b6c3b RIP: guc_exec_queue_timedout_job+... Defer the wedge until the handler has finished operating on the queue, right before returning DRM_GPU_SCHED_STAT_NO_HANG, so the teardown no longer races with this handler's use of @q. Fixes: 770031ec2312 ("drm/xe: fix job timeout recovery for unstarted jobs and kernel queues") Suggested-by: Matthew Brost <matthew.brost@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Cc: Sanjay Yadav <sanjay.kumar.yadav@intel.com> Assisted-by: GitHub-Copilot:claude-opus-4.8 Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260612162414.287971-2-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> (cherry picked from commit a889e9b06bfdb375fc88b3b2a4b143f621f930c6) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-07-01dpaa2-switch: add support for imprecise source portIoana Ciornei2-2/+16
Switch ports configured as part of a LAG group are not able to provide a precise source port for all packets which reach the control interface. The only frames which will have a precise source port are those that are explicitly trapped, for example STP and LCAP frames. For any other frames (for example, those which are flooded) we can only know the ingress LAG group. Take into account the DPAA2_ETHSW_FLC_IMPRECISE_IF_ID bit and based on its value target the bond device or the specific source netdevice. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-14-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: trap all link local reserved addresses to the CPUIoana Ciornei1-7/+6
Do not trap only STP frames to the control interface but rather trap all link local reserved addresses. This will still be done by looking at the destination MAC address but keeping in mind to not take into account the last byte. This change will benefit LACP frames which now will reach the control interface. While at it, change the prototype of the dpaa2_switch_port_trap_mac_addr() function so that we directly pass a 'const u8 *' so that it matches the ether_addr_copy() used. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-13-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: offload port objects on an upper bond deviceIoana Ciornei1-28/+41
This patch adds support for offloading port objects, VLANs and MDBs, added on upper bond devices. First of all, the use of the switchdev_handle_*() replication helpers is introduced for the SWITCHDEV_PORT_OBJ_ADD/SWITCHDEV_PORT_OBJ_DEL events. With this change, setting up the 'port_obj_info->handled = true' is not needed anymore since it's now handled by the new helpers. In the DPAA2 architecture, there is no difference in adding a FDB or MDB which points towards a LAG port. Unlike other architectures, we do not need to populate all the possible destinations which are under the LAG, we only have to specify a single queueing destination (QDID) which represents the LAG. This all means that handling of MDBs in bond devices needs to have refcount mechanism as with the FDBs. This mechanism is triggered by calling the dpaa2_switch_lag_fdb_add() / dpaa2_switch_lag_fdb_del() functions which were added in the previous patch. Also change how dpaa2_switch_port_mdb_del() behaves in case the underlying HW operation failed. Since the delete operations cannot be stopped from a switchdev standpoint, go ahead and ignore the return code from the dpaa2_switch_*_fdb_del() calls. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-12-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: offload FDBs added on an upper bond deviceIoana Ciornei2-26/+225
This patch adds support for offloading FDB entries added on upper bond devices. First of all, the call to switchdev_bridge_port_offload() is updated so that the notifier blocks needed for FDB events replay are available to the bridge core. Using switchdev_handle_*() helpers is also necessary because each FDB event needs to be fanned out to any DPAA2 switch lower device. This triggers another change in the return type used by the dpaa2_switch_port_fdb_event() - from notifier types to regular errno types. Handling of the SWITCHDEV_FDB_ADD_TO_DEVICE/SWITCHDEV_FDB_DEL_TO_DEVICE events is updated so that the newly dpaa2_switch_lag_fdb_add() / dpaa2_switch_lag_fdb_del() functions are called anytime a port is under a bond device. This will allow us to manage refcounting on FDB entries which are added on the upper bond devices. The DPAA2 switch uses shared-VLAN learning which means that the vid parameter is not used when adding an FDB entry to HW. The current behavior when dealing with FDB entries with the same MAC address but different VLANs is to add the entry to HW every time while removal will get done on the first 'bridge fdb del' command issued by the user. The same behavior is kept also for FDBs added on bond devices by keeping the refcount on the {vid, addr} pair while the HW operation disregards entirely the vid parameter. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-11-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: add support for LAG offloadIoana Ciornei2-12/+476
This patch adds the bulk of the changes needed in order to support offloading of an upper bond device. First of all, handling of the NETDEV_CHANGEUPPER and NETDEV_PRECHANGEUPPER events is extended so that the driver is capable to handle joining or leaving an upper bond device. All the restrictions around the LAG offload support are added in the newly added dpaa2_switch_pre_lag_join() function. The same events are extended to also detect if one of our upper bond devices changes its own upper device. In this case, on each lower device that is DPAA2 the corresponding dpaa2_switch_port_[pre]changeupper() function will be called. This will start the process of joining the same FDB as the one used by the bridge device. Setting the 'offload_fwd_mark' field on the skbs is also extended to be setup not only when the port is under a bridge but also under a bond device that is offloaded. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-10-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: add LAG configuration APIIoana Ciornei3-1/+107
Add the necessary APIs to configure and control the LAG support on the DPAA2 switch object. - The dpsw_lag_set() function will be used to either verify that a LAG configuration can be support or to actually apply it in HW. - The dpsw_if_set_lag_state() will get used in the next patches to change the per port LAG state of a specific DPSW interface. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-9-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: consolidate unicast and multicast managementIoana Ciornei1-12/+27
This patch consolidates the unicast and multicast management by creating two new functions - dpaa2_switch_port_fdb_[add|del]() - which can be used for either uc or mc addresses. Having this common entrypoint for both types of addresses will help us in the next patches to streamline the same addresses but on LAG ports. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-8-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: add dpaa2_switch_port_to_bridge_port() helperIoana Ciornei1-3/+20
In preparation for adding offloading support for upper bond devices we have to let the switchdev framework know if a specific bridge port is offloaded or not, even if that brport is an upper device. For this to happen, create the dpaa2_switch_port_to_bridge_port function which will determine the bridge port corresponding to a particular DPAA2 switch interface and use it in the switchdev_bridge_port_offload call. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-7-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: check early if an FDB entry should be addedIoana Ciornei1-4/+3
Instead of waiting until the last moment to check if an FDB entry should be added to HW, move the check earlier (before even scheduling the work item) so that we don't just waste time. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-6-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: create a separate dpaa2_switch_port_fdb_event() functionIoana Ciornei1-7/+21
Create a separate dpaa2_switch_port_fdb_event() function that will only handle the FDB related events. With this change, the dpaa2_switch_port_event() notifier handler can be written in a way that it's easier to follow. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-5-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: extend the FDB management to cover bond scenariosIoana Ciornei1-10/+25
The dpaa2_switch_fdb_for_join() function is responsible with determining what FDB should be used by a port as a consequence of it joining a bridge. The rule is that all DPAA2 switch ports under the same bridge will use the FDB of the first port which joined that bridge. Extend the function so that the function also covers the scenario in which there is bridged bond device. For this to happen, in case a bond device is encountered through the bridge ports the function needs to descend one level through its lowers as well. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-4-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: avoid holding rtnl_lock in dpaa2_switch_event_work()Ioana Ciornei1-2/+8
The only reason why the rtnl_lock is held in the dpaa2_switch_event_work() is so that there is no concurency between the changeupper notifier which manages the per port FDB assignment and the workqueue which adds / deletes addresses into that forwarding database. To avoid this kind of concurency without a rtnl_lock, flush the event workqueue as the last step from the pre_bridge_leave so that any in-flight operations targeting the current FDB are finalized before the bridge layout (and the per port FDB assignment) changes. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-3-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01dpaa2-switch: remove unnecessary dev_mc_add/dev_mc_del callsIoana Ciornei1-48/+2
The DPSW object does not implement strict address filtering thus any call to the dev_mc_add() / dev_mc_del() is pointless. Remove these calls from the dpaa2_switch_port_mdb_add() and dpaa2_switch_port_mdb_del() functions. And since the multicast addresses no longer reach the netdev->mc list, there is no point in keeping the dpaa2_switch_port_lookup_address() function which searches through that list to verify if the same address is added multiple times. Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com> Link: https://patch.msgid.link/20260629112309.154328-2-ioana.ciornei@nxp.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-01drm/amdgpu: Do not fiddle with the idle workers too muchTvrtko Ursulin4-24/+20
Idle workers only need to be canceled or pushed back if we are potentially idle. Make the both operations conditional on the pre-increment and post- decrement status of the in-flight job counter. Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: Save some cycles on the job submission pathTvrtko Ursulin4-10/+16
Every job submission on the Steam Deck ends up walking the list of IP blocks looking for AMD_IP_BLOCK_TYPE_SMC. Half of the call chain is like the below, while the second half is from amdgpu_gfx_profile_ring_end_use: amdgpu_gfx_profile_ring_begin_use amdgpu_dpm_is_overdrive_enabled is_support_sw_smu amdgpu_device_ip_is_valid On a game menu screen at 90Hz refresh rate we end up with ~840 calls per second which sticks out when the submission worker is profiled with perf: 13.78% [kernel] [k] __lock_text_start 10.86% [kernel] [k] __lookup_object 8.76% [kernel] [k] __mod_timer 4.94% [kernel] [k] queued_spin_lock_slowpath 1.66% [kernel] [k] amdgpu_device_ip_is_valid 1.54% [kernel] [k] preempt_count_add 1.42% [kernel] [k] amdgpu_sync_peek_fence 1.18% [kernel] [k] amdgpu_vmid_grab 1.17% [kernel] [k] amdgpu_ib_schedule 1.14% [kernel] [k] kthread_worker_fn Lets short-circuit this walk by simply caching the result of is_support_sw_smu() in the device. This is a micro-improvement but it is at least conceptually nicer to avoid repeating the same walk so much. Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-01drm/amdgpu: Remove unused amdgpu_device_ip_is_hwTvrtko Ursulin2-23/+0
This function is unused so lets remove it. Reviewed-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>