summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-09-23drm/amd/display: Add inst field to struct dmub_psrTony Cheng
Add an inst member to struct dmub_psr and set it to 0 in dmub_psr_construct(), since the PSR object is a pool singleton. No functional change; the field has no readers yet. Reviewed-by: Jun Lei <jun.lei@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Tony Cheng <Tony.Cheng@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/display: Add inst field to struct abmTony Cheng
Add an inst member to struct abm and set it to 0 in dce_abm_construct() and dmub_abm_construct(), since ABM is a singleton. No functional change; the field has no readers yet. Reviewed-by: Jun Lei <jun.lei@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Tony Cheng <Tony.Cheng@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/display: Add Back Unified CalculateFlipScheduleAustin Zheng
[Why] CalculateFlipSchedule has slightly different calculations depending on if it was called by mode support or mode programming. Mode support calculates the lower bound of the required bandwidth for immediate flips. This takes into the account of the register limits to ensure it is still programmable. Mode programming uses the required bandwidth for immediate flips on a per-plane basis to calculate the number of dst_y lines needed to achieve this bandwidth. Usually the immediate flip bandwidth per plane determined by mode programming is above the lower bound calculated by mode support. However, mode programming can fail if that isn't the case since a bandwidth lower than the lower bound will end up exceeding the register limit used by hardware. e.g. The proportion of a single plane's flip bandwidth w.r.t to the total bandwidth available for all planes can result in one of the planes having a lower BW than the lower bound calculated in mode support [How] Update function to always use the use_lb_flip_bw path. Add calculations for dst_y_per_vm/row_flip lines. Consolidate calculation of lb_flip_bw by having it consider register limits: Instead of doing two steps of: 1. Taking the max of the bandwidths without considering register limits. 2. Taking the max of itself with the bandwidths with register limits accounted for. Do it in one step as it is easy to miss either step 1 or 2. Also add some local variables for intermediate values and remove no longer referenced inputs to improve readability. Also increase DCN401 max_flip_time_lines by 2 lines to ensure previously supported configs remain supported as worst-case bandwidth can increase compared to before. Fixes: 1e719006b623 ("drm/amd/display: Unify CalculateFlipSchedule Logic") Fixes: 285a363f8c63 ("Revert "drm/amd/display: Unify CalculateFlipSchedule Logic"") Reviewed-by: Dillon Varone <dillon.varone@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Austin Zheng <Austin.Zheng@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/display: Add inst field to struct clk_mgrTony Cheng
Add an inst member to struct clk_mgr and set it to 0 in the DCN401, DCN42, DCN42B and DCN60 construct paths, since clk_mgr is a singleton on all of them. No functional change; the field has no readers yet. Reviewed-by: Jun Lei <jun.lei@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Tony Cheng <Tony.Cheng@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/display: Enable double buffering for DSCCLK updatesAlvin Lee
[Description] Double buffering needs to be enabled for DSCCLK updates otherwise a frame of underflow could occur when updating the DSC pipe config or DSC clock. Reviewed-by: Ilya Bakoulin <ilya.bakoulin@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/display: Add inst field to struct hubbubTony Cheng
Add an inst member and initialize it to 0 in every hubbub*_construct() from DCN10 through DCN60. No functional change. Reviewed-by: Jun Lei <jun.lei@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Tony Cheng <Tony.Cheng@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/display: add SPDX-License-IdentifierTony Cheng
Add the AMD Open-Source SPDX line to dc files. Reviewed-by: Jun Lei <jun.lei@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Tony Cheng <Tony.Cheng@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/display: Expose 3 overlay planes on DCN6Ivan Lipski
[Why&How] DCN6 has 4 pipes, so we should be able to use 3 overlay + 1 primary plane. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/display: Forward periodic ABM keep-alive scenario to DMUHuang, Leon
[Why & How] 1. The periodic ABM full-frame update for VESA PR is now owned by the DMU timer. 2. In PR_update_state, compute whether the current scenario allows the periodic keep-alive (not CTS, not front-buffer rendering, not force-full-frame, content actively updating) and forward it via the abm_periodic_ffu_allowed runtime flag only when it changes. Reviewed-by: Robin Chen <robin.chen@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Leon Huang <Leon.Huang1@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()Wentao Liang
amdgpu_debugfs_test_ib_show() resumes the device with pm_runtime_get_sync() before taking the reset domain semaphore with down_write_killable(). If the write lock acquisition is interrupted, the function returns without calling pm_runtime_put_autosuspend(), leaking the runtime PM reference acquired for the device and keeping the GPU awake. Drop the runtime PM reference on the interrupted down_write_killable() error path before returning. Fixes: 6049db43d6dd ("drm/amdgpu: change reset lock from mutex to rw_semaphore") Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()Wentao Liang
amdgpu_vm_init() initializes vm->last_update, vm->last_unlocked and vm->last_tlb_flush with references to the stub fence taken via dma_fence_get_stub(). The error label at the end of the function releases the last_unlocked and last_tlb_flush references with dma_fence_put(), but the reference stored in vm->last_update is never dropped, so whenever the page table root creation, the reservation of the root BO or the PASID registration fails, the stub fence reference leaks. Drop the vm->last_update reference together with the other stub fence references on the error path. Fixes: 187916e6ed9d ("drm/amdgpu: install stub fence into potential unused fence pointers") Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()Wentao Liang
amdgpu_acpi_enumerate_xcc() looks up each XCC ACPI device with acpi_dev_get_first_match_dev(), which takes a reference to the device. The reference is dropped with acpi_dev_put() after the XCC info is initialized, but if the kzalloc_obj() allocation of the XCC info fails the function returns -ENOMEM without releasing the reference, leaking the last reference to the ACPI device. Drop the ACPI device reference on the allocation failure path before returning. Fixes: 4d5275ab0b18 ("drm/amdgpu: Add parsing of acpi xcc objects") Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()Wentao Liang
amdgpu_ring_init() initializes ring->vmid_wait with a reference to the stub fence taken via dma_fence_get_stub(). When a later step of the initialization fails, e.g. amdgpu_fence_driver_init_ring(), a writeback slot allocation or the ring buffer allocation, the function returns an error without releasing the stub fence reference and the reference is leaked if the ring is torn down without amdgpu_ring_fini(). Move the stub fence assignment to the end of the initialization, right before the ring is registered with the GPU scheduler, where no further failure is possible. The stub fence is only consumed by command submission handling in amdgpu_ids.c once the ring is up and running, so nothing reads it during the error-prone part of the initialization. Fixes: 48e9fbd1a284 ("drm/amdgpu: initialize the vmid_wait with the stub fence") Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/pm: Drop redundant power_context_sizeLijo Lazar
The size is stored and cleared in init/fini but never used to for anything else like copy. Drop the size and use pointer for init/fini checks. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/pm: Fix SMUv14/15 power context allocationLijo Lazar
Allocate the right power context objects in smu v14 and smu v15 Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mappingAsad Kamal
kfd_dev_mapping caches the address_space of the first /dev/kfd opener so that the GPU reset path can call unmap_mapping_range() to zap all userspace mappings of doorbell and MMIO ranges. This design has two bugs that both manifest under SRIOV with multiple containers: 1. Use-after-free / rwsem deadlock. The cached pointer refers to an inode owned by the first opener's container. When that container exits and its inode is released, kfd_dev_mapping becomes a dangling pointer. A subsequent GPU reset dereferences it inside unmap_mapping_range(), which takes i_mmap_rwsem on the freed inode, causing a hard hang observable as an uninterruptible rwsem wait. 2. Multi-container gap. Only the first opener's address_space is cached; VMAs created by later openers live in a different address_space and are never reached by unmap_mapping_range(). After a GPU reset those stale mappings keep doorbell and MMIO pages accessible to guest userspace with no GPU behind them, risking PCIe transaction timeouts and NMI panics. Fix both bugs with the same approach used by DRM core (drm_drv.c): create a private pseudo-filesystem at module init time and allocate one anonymous inode from it. In kfd_open() redirect every opener's file->f_mapping to that inode's address_space. The inode is module-owned, lives exactly as long as the amdgpu module, and collects VMAs from all openers in one address_space. A single unmap_mapping_range() call in the reset path then correctly reaches every container's mappings with no dangling pointer risk. The hang manifests as an NMI backtrace on the GPU reset workqueue stuck spinning in rwsem_down_read_slowpath() with a corrupted i_mmap_rwsem: Workqueue: amdgpu-reset-dev xgpu_ai_mailbox_flr_work [amdgpu] Call Trace: <TASK> kvm_wait+0x1f/0x40 __pv_queued_spin_lock_slowpath+0x31d/0x3a0 _raw_spin_lock_irq+0x51/0x80 rwsem_down_read_slowpath+0xb3/0x550 down_read+0x48/0xd0 unmap_mapping_range+0x71/0x140 kfd_dev_unmap_mapping_range+0x5b/0x140 [amdgpu] amdgpu_amdkfd_clear_kfd_mapping+0xd8/0x190 [amdgpu] amdgpu_device_gpu_recover+0x232/0x450 [amdgpu] xgpu_ai_mailbox_flr_work+0xb5/0xc0 [amdgpu] process_one_work+0x18e/0x3e0 worker_thread+0x2e3/0x420 kthread+0x10a/0x230 Fixes: 70cadefcc616 ("drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu: Move GC v12.1 spm vmid init to hw initLijo Lazar
GC reset is not released during sw init and hence it shouldn't be accessed. Move spm vmid programming to hw init phase. This programming may later be overridden with the job's vmid. Fixes: ad5f1ee0a9b0 ("drm/amdgpu: Add initial support for gfx v12_1") Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/ras: remove obsolete ras mp1 v13 manager codeYiPeng Chai
Remove obsolete ras mp1 v13 manager code. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/ras: use common mp1 ras interface for v13YiPeng Chai
Use the common mp1 ras manager interface for MP1 v13_0. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/ras: add MP1 RAS feature status queryYiPeng Chai
Add a generic MP1 interface to query the status of RAS-related SMU features, including the PMFW EEPROM feature. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu/mes12.1: add more debug info on MES packet failureSunil Khatri
When MES fails to respond to a packet, the existing failure log only prints the op name. Add fence_wait_ret and the packet's status word to the same message. status_ptr is written directly by MES as part of completing the packet, independently of the ring fence that fence_wait_ret waits on, so a nonzero status despite a timed-out fence_wait_ret narrows the failure to the trailing ring/query-status packet rather than the original request. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu/mes11: add more debug info on MES packet failureSunil Khatri
When MES fails to respond to a packet, the existing failure log only prints the op name. Add fence_wait_ret and the packet's status word to the same message. status_ptr is written directly by MES as part of completing the packet, independently of the ring fence that fence_wait_ret waits on, so a nonzero status despite a timed-out fence_wait_ret narrows the failure to the trailing ring/query-status packet rather than the original request. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu/mes12: add more debug info on MES packet failureSunil Khatri
When MES fails to respond to a packet, the existing failure log only prints the op name. Add fence_wait_ret and the packet's status word to the same message, so a fence-wait timeout (MES itself stalled) can be told apart from a fast explicit rejection (fence signaled, but the low status word is 0) directly from the log, along with the MES-reported error code carried in the high status word for the latter case. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu/vcn4.0.3: fix video_timeout unit mismatch in jpeg reset waitSunil Khatri
vcn_v4_0_3_reset_jpeg_pre_helper() passes adev->video_timeout directly to amdgpu_fence_wait_polling(), whose timeout parameter is documented and implemented in usecs (busy-wait loop decrementing by udelay(2)). adev->video_timeout is set in jiffies by amdgpu_device_get_job_timeout_settings(), via msecs_to_jiffies(). Passing it unconverted means the intended ~2s wait for outstanding JPEG fences to complete before the JPEG queue is torn down actually lasts only a couple of microseconds (HZ jiffies interpreted as usecs), so pending jobs are almost never given a real chance to finish before the reset path forces completion in the following helper. Convert the jiffies value to usecs with jiffies_to_usecs() before passing it to amdgpu_fence_wait_polling(). Fixes: d25c67fd9d6f ("drm/amdgpu/vcn4.0.3: rework reset handling") Cc: Jesse.Zhang <Jesse.Zhang@amd.com> Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu/vcn5.0.1: fix video_timeout unit mismatch in jpeg reset waitSunil Khatri
vcn_v5_0_1_reset_jpeg_pre_helper() passes adev->video_timeout directly to amdgpu_fence_wait_polling(), whose timeout parameter is documented and implemented in usecs (busy-wait loop decrementing by udelay(2)). adev->video_timeout is set in jiffies by amdgpu_device_get_job_timeout_settings(), via msecs_to_jiffies(). Passing it unconverted means the intended ~2s wait for outstanding JPEG fences to complete before the JPEG queue is torn down actually lasts only a couple of microseconds (HZ jiffies interpreted as usecs), so pending jobs are almost never given a real chance to finish before the reset path forces completion in the following helper. Convert the jiffies value to usecs with jiffies_to_usecs() before passing it to amdgpu_fence_wait_polling(). Fixes: fab47d2db5ca ("drm/amdgpu/vcn5.0.1: rework reset handling") Cc: Jesse.Zhang <Jesse.Zhang@amd.com> Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu: Resync UALink ring wptr after rebootPhilip Yang
When one side of UALink nodes reboots, its ring wptr resets to 0 while the peer keeps a stale value. Read the remote wptr and adopt it as the local wptr and rptr to resync, before the first message is sent. Either side can notice first, so do this both when setting up the connection and when receiving the HELLO from the peer. On the sdma path, read the wptr in a fence callback because the IB buffer holding the result is recycled once the fence signals, so reading it after dma_fence_wait_timeout() is too late. The lsdma path copies synchronously, so it reads the wptr directly. Take peer->lock in the callers (amdgpu_ualink_remote_interrupt and amdgpu_ualink_remote_shootdown) instead of in amdgpu_ualink_send_command, so the ring->ready check and the send are atomic against a concurrent ring reset. Move the rptr refresh and ring-full check out of amdgpu_ualink_send_command() into amdgpu_ualink_ring_check_space(), so it runs under the caller's peer->lock before the job is allocated. On a failed NPA-REQ send, reset the connection like the NPA-RSP timeout path already does, so the next attempt resyncs the ring wptr. On connection reset, amdgpu_ualink_reset_peer_rings() only clears ring->ready, so the writeback address is re-registered on the next send. v10: - Fix the resync missed on the receiving side: after a reboot the peer may send HELLO before we set up the connection, so resync the ring wptr in amdgpu_ualink_process_hello_msg() too. v9: - Fix the unnecessary connection reset after an app exits: the peer is idle here but still busy handling NPA revokes on the remote, so the HELLO reset a healthy connection. Only send it if the wptr changed. - Resync both rings together under peer->lock, read both remote wptr before updating either so a failed read changes nothing. v8: - Fix regression with concurrent import ioctls: do the idle check and ring reset in amdgpu_ualink_setup_connection() under conn_state->lock, and return -EAGAIN for IN_PROGRESS/PENDING first. - Reset the peer rings only, the imp/exp xarray cleanup is not needed to resync wptr. v7: - With v6 reboot one node of vPOD test passed on minirack. - Use the per-remote imported and exported handle lists for the idle check instead of walking the xarrays. - Rename amdgpu_ualink_resync_peer_rings() to amdgpu_ualink_reset_peer_rings(), it only clears ring->ready. v6: - Check idleness per remote accelerator instead of globally, and reset the stale connection at the import ioctl so the peer re-runs the HELLO handshake after a reboot. v5: - Resync the ring pointers at the import ioctl when the connection is completely idle (no exported or imported BOs), so the first command from a new application after a remote reboot/reset succeeds. - Put the sdma wptr read fence callback on the stack instead of allocating it; it is cancelled on timeout so it never outlives the call. v4: - Cancel the sdma fence callback on the wait timeout/failure path so it cannot write into the caller's stack after the function returns, and free the callback state in one place. v3: - Resync both rings at connection setup instead of on the send path. - Set the writeback rptr too, the stale value disagrees with the resynced wptr until the remote FW writes it back. v2: - Match the FW change: resync wptr only on the first send or after a timeout, instead of checking the remote periodically. Suggested-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Philip Yang <Philip.Yang@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Mukul Joshi <mukul.joshi@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu: Initialize UALink handle uniqueness stateKarl Mehltretter
amdgpu_generate_ualink_handle() continues when handle_lo is zero. For accelerator ID 0, the random value can become zero after the low 10 bits are cleared. This path reaches while (!unique) without assigning unique. Clang's -Wconditional-uninitialized reports the read. A reduced MemorySanitizer test reports use-of-uninitialized-value at the loop condition. If the uninitialized value ends the loop, handle 0 is inserted into exp_xa while robj->ualink_handle_lo still says that the BO has no handle. A later export can create another entry for the same BO. Initialize unique to false so the zero-handle path repeats the loop. Fixes: c67cb19811ec ("drm/amdgpu: Implement UALink handle export") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu/userq: fix double jiffies conversion in hang detect timeoutSunil Khatri
Function amdgpu_userq_start_hang_detect_work() calls msecs_to_jiffies() on adev->gfx_timeout/compute_timeout/sdma_timeout before arming hang_detect_work. These timeout values already hold jiffies values from amdgpu_device_get_job_timeout_settings() at device init. This silently shrinks the real hang-detect deadline to (2 * HZ) ms instead of the intended timeout. e.g. 500ms instead of the 2000ms default on a CONFIG_HZ=250 kernel, only coincidentally correct at HZ=1000. The shortened window is easily exceeded by ordinary fence-completion latency, causing hang_detect_work to fire and trigger a per-queue or full GPU reset for queues that are not actually hung. Pass the jiffies value directly to queue_delayed_work() instead of converting it a second time. Fixes: fc3336be9c62 ("drm/amd/amdgpu: Add independent hang detect work for user queue fence") Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu: Fix NULL dereference in amdgpu_ualink_info_set_accel_stateSrinivasan Shanmugam
Commit 0a6da5dcfe42 ("drm/amdgpu: Improve ualink state transitions") introduced an access to info->accel_state before checking whether info is NULL. Move the access after the NULL check to avoid a potential NULL pointer dereference. Fixes: 0a6da5dcfe42 ("drm/amdgpu: Improve ualink state transitions") Reported-by: Dan Carpenter <error27@gmail.com> Cc: Lijo Lazar <lijo.lazar@amd.com> Cc: Felix Kuehling <felix.kuehling@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/ras: support aca debug mode for mp1 v13_0YiPeng Chai
Use uniras generic mp1 message to enable/disable aca debug mode on mp1 v13_0. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/ras: add pmfw-managed eeprom support for mp1_v13_0YiPeng Chai
Add pmfw-managed eeprom support for mp1_v13_0. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/ras: retrieve ras error info via common interface and message for ↵YiPeng Chai
mp1_v13_0 Retrieve ras error info via common interface and message for mp1_v13_0. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu: move userq fence wait out of signalling sectionPrike Liang
The eviction fence suspend worker waits for every pending userq fence from inside a dma_fence_begin_signalling() critical section. Waiting on another DMA fence while responsible for signalling one violates the cross-driver fence contract and is reported by lockdep as a dma_fence_map dependency. Move the wait before dma_fence_begin_signalling(). Keep userq_mutex held so queue lifetime remains stable while inspecting last_fence. Fixes: fc61df151617 ("drm/amdgpu: annotate eviction fence signaling path") Signed-off-by: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/pm: Add GetRmaStatus messageYiPeng Chai
Add GetRmaStatus message for smu_v13_0_12 and smu_v15_0_8. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Kevin Wang <kevin.wang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu/mes12: clear event log on resume to avoid MES page faultJesse Zhang
The MES event-log/MSCRATCH region is only zeroed once at sw_init. On the resume path (hw_init without sw_init) it retains stale data, so with mes_log_enable=1 the MES firmware walks stale pointers on activation and triggers a recoverable CPC page fault: [gfxhub] page fault (src_id:0 ring:153 vmid:0 pasid:0) in page starting at address 0x000000855c237000 from client 10 GCVM_L2_PROTECTION_FAULT_STATUS:0x00000B33 Faulty UTCL2 client ID: CPC (0x5) MORE_FAULTS: 0x1 WALKER_ERROR: 0x1 PERMISSION_FAULTS: 0x3 MAPPING_ERROR: 0x1 RW: 0x0 Re-clear it before unhalting MES. Reviewed-by: James Zhu <James.Zhu@amd.com> Tested-by: James Zhu <James.Zhu@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()Wentao Liang
In dm_update_crtc_state(), when a modeset is required the newly created stream is stored in dm_new_crtc_state->stream and an extra reference is taken with dc_stream_retain(). The reference returned by create_validate_stream_for_sink() is released as an extra reference at the skip_modeset label, leaving the stream owned by the new CRTC state. If amdgpu_dm_check_crtc_color_mgmt() fails afterwards, the code jumps to the fail label which releases new_stream again. Since the extra reference was already released at skip_modeset, this drops the reference owned by dm_new_crtc_state->stream and the stream is released while the atomic state still points to it, leading to a premature free of the dc stream. Set new_stream to NULL after releasing the extra reference at the skip_modeset label so that a later goto fail cannot release the reference owned by the new CRTC state. Fixes: 7cd4b70091a5 ("drm/amd/display: Rework CRTC color management") Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amdgpu: Check for PCIe atomic ops support when reading pf2vf dataVictor Lu
The critical region v2 patches clear the fw_reserve.p_pf2vf variable after pf2vf data is read the first time. have_atomics_support relies on that variable to check for PCIe atomic ops support. Move have_atomics_support check for SRIOV VFs to be when pf2vf data is read. Signed-off-by: Victor Lu <victorchengchi.lu@amd.com> Reviewed-by: Ellen Pan <yunru.pan@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd/ras: enable UniRAS for psp v15_0_8Candice Li
Enable UniRAS for psp v15_0_8. Signed-off-by: Candice Li <candice.li@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/amd: set CP_HQD_PQ_CONTROL.SCOPE for PM4 and KCQs on GFX 12.1Mukul Joshi
The previous change set CP_HQD_PQ_CONTROL.SCOPE=3 (SYSTEM) only for KFD AQL queues, but PM4 queues and the kernel-managed compute (KCQ) queues can also use non-coherently cached ring buffers and hit the same stale-packet problem. Set the scope for both PM4 queues and KCQs as well. Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com> Signed-off-by: Mukul Joshi <mukul.joshi@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-09-23drm/xe/display: reduce includes in xe_display.cJani Nikula
xe_display.c has a bunch of extra leftover includes. Remove and simplify. Reviewed-by: Michał Grzelak <michal.grzelak@linux.intel.com> Link: https://patch.msgid.link/20260922151721.1483978-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-23drm/pagemap: Drop ratelimiting from dev_unhold_work debug traceVarun Gupta
Reference-drop trace in drm_pagemap_dev_unhold_work() was changed from drm_dbg() to drm_dbg_ratelimited() to reduce serial console bottlenecks. However, when the ratelimit kicks in, the kernel's ratelimiting subsystem logs a "callbacks suppressed" notification at the KERN_WARNING level. Revert the trace macro back to drm_dbg() Fixes: b66b036c959f ("drm/pagemap: Prevent CPU stalls during unbounded pagemap teardown") Signed-off-by: Varun Gupta <varun.gupta@intel.com> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Acked-by: Maxime Ripard <mripard@kernel.org> # For merging through drm-xe only. (IRC) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/20260921062648.1166903-2-varun.gupta@intel.com
2026-09-23configfs: Constify is_visible/is_visible_bin in configfs_group_operationsThomas Weißschuh
These callbacks are never meant to modify their configfs_attribute structure. Enforce this in the type system. As there are only two implementers of these callbacks, adapt them right away, avoiding a phased transition. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Reviewed-by: Breno Leitao <leitao@debian.org> Acked-by: Andreas Hindborg <a.hindborg@kernel.org> Link: https://patch.msgid.link/20260716-configfs-const-base-v1-2-c545a4053cb5@weissschuh.net Signed-off-by: Breno Leitao <leitao@debian.org>
2026-09-23drm/tyr: reduce size of doorbell arrayDeborah Brouwer
Currently the number of doorbells is set to 64 which is an architectural maximum for the Mali GPU major v10 supported by Tyr. Since each doorbell needs a 64 KiB page, the doorbell array alone would need 4 MiB of register memory. Since the doorbell array starts at offset 0x80000, its exclusive end would be 0x480000, but the rk3588 device that Tyr is compatible with only provides a 2 MiB iomem region in total. Reduce the number of doorbells so that they fit into the rk3588 iomem region. This is consistent with Panthor’s doorbell id assignment. Doorbell 0 is the global doorbell. Panthor assigns the remaining doorbells to the active command stream group (CSG) slots. The number of slots is capped at 16 (MAX_CSG_PRIO + 1). Therefore Panthor uses a maximum of 17 doorbells. The 17 doorbell pages span 0x110000 bytes. Since the doorbell array starts at offset 0x80000 its exclusive end is 0x190000 and so fits within the 2 MiB register region. Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com> Link: https://patch.msgid.link/20260910-b4-doorbell-v1-1-f3ca2f501600@collabora.com Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2026-09-23file: make struct fd_prepare const and kill its err fieldChristian Brauner
FD_PREPARE() releases the fd as soon as the file expression fails. The fd either holds the descriptor or the error. The separate field is redundant. Make fd and file plain members and struct fd_prepare simpler. Callers of FD_PREPARE() get a const pointer to the guard. Simplify all users as they can now easily access the trivial struct. No functional changes. Link: https://patch.msgid.link/20260917-work-file-fd_prepare-v1-4-b87534ca49f3@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-09-23drm/sched: Free the run queues at the end of drm_sched_fini()Donggeun Yoo
drm_sched_fini() frees the run queues at the top of teardown but the array holding them at the bottom. The early half is on the wrong side of cancel_delayed_work_sync(&sched->work_tdr), which waits for a timeout handler that can still walk sched->sched_rq[i] through drm_sched_increase_karma(). No correct driver can be there, since every fence returned from run_job() must be signaled before drm_sched_fini() is called. Free the entries next to the array anyway, so run-queue teardown happens in one place. Link: https://lore.kernel.org/dri-devel/20260910054605.634135-1-donggeunyoo.kernel@gmail.com/ Assisted-by: Claude:claude-fable-5 Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Signed-off-by: Philipp Stanner <phasta@kernel.org> Link: https://patch.msgid.link/20260910121601.805032-1-donggeunyoo.kernel@gmail.com
2026-09-23drm/tyr: gpu_info: zero out new/unused fieldsDeborah Brouwer
If a new field is added to the struct drm_panthor_gpu_info in the panthor uapi, Tyr must initialize this field or it will cause a compile error. To pre-emptively avoid compile errors, use ..pin_init::zeroed() to zero out all new fields added to this struct. Tyr can subsequently change the initialization as necessary. Also use it instead of manually zeroing out existing fields at the end of the struct. Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com> Link: https://patch.msgid.link/20260922-b4-gpu_info_zero-v1-1-7259840069c6@collabora.com Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2026-09-22drm/xe/pf: Keep VF LMEM BAR size low if no VFs enabledMarcin Bernatowicz
When VFs are enabled on dGFX the driver resizes the PF VF_LMEM_BAR to fit the requested layout. After VFs are disabled the PF VF BAR size is left as-is. On platforms with tight MMIO apertures a subsequent unplug/rescan followed by another enable may fail with: "VF BAR …: can't assign; no space" because the PCI core reserves address space based on the (now large) VF template, often multiplied by totalvfs. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5937 Fixes: 94eae6ee4c2d ("drm/xe/pf: Set VF LMEM BAR size") Signed-off-by: Marcin Bernatowicz <marcin.bernatowicz@linux.intel.com> Cc: Michał Wajdeczko <michal.wajdeczko@intel.com> Cc: Michał Winiarski <michal.winiarski@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260918110130.700332-1-marcin.bernatowicz@linux.intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-09-22drm/xe: Add wa_14025941587 to xe2, xe3 and xe3p platformsTangudu Tilak Tirumalesh
Avoid programming the IDLEDLY timer to less than 5 microseconds. Apply wa_14025941587 to Graphics Versions 20.01 to 35.11 and Media Versions 13.01 to 35.03 v2: Use xe_rtp_match_not_sriov_vf, move to local variable Remove warn and other knits - Matt R v3: Add verbose comment - Tejas v4: Restore IDLE_DLY register on engine reset. Add it to GUC save-restore list. -Vivek v5: Extend WA to Media Versions 13.01 to 35.03 - Vinay v6: Avoid clearing inhibit switch - Bala Refactor code accordingly by adding idle_reg_val. v7: Rebased with the divide-by-zero/overflow guards living in a separate hardening patch. v8: Preserve the Wa_16023105232 floor (DIV_ROUND_DOWN_ULL) and the maxcnt == 0 guard from the hardening patch. Round up (DIV_ROUND_UP_ULL) the Wa_14025941587 minimum conversion instead, so the tick-quantized delay cannot round back below 5 us. v9: Evaluate the Wa_16023105232 xe_gt_WARN_ON() against the value read from hardware instead of the Wa_14025941587-bumped value, so it no longer fires on the driver's own floor. Re-check the rounded-up tick value against maxcnt and floor it if tick quantization pushed it back to/above maxcnt, logging via xe_gt_dbg since this is the driver's own value, not a hardware anomaly. Assisted-by: GitHub_Copilot:claude-opus-4.8 Signed-off-by: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com> Reviewed-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com> Link: https://patch.msgid.link/20260916100545.779894-3-tilak.tirumalesh.tangudu@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit 9453c528fc909076468ff10df1c2e334ca5a9b00) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-09-22drm/xe: harden adjust_idledly() against divide-by-zero and overflowTangudu Tilak Tirumalesh
adjust_idledly() has several corner-case issues flagged during review: 1. If xe_gt_clock_init() failed to recognise the crystal clock, gt->info.timestamp_base is 0, which makes idledly_units_ps also 0. The subsequent DIV_ROUND_CLOSEST(..., idledly_units_ps) is then a divide-by-zero and panics the kernel. 2. The tick-to-ns conversions are done in u32: idledly * idledly_units_ps, (maxcnt - 1) * 1000 Both overflow u32 before DIV_ROUND_CLOSEST() sees them. 3. If IDLE_WAIT_TIME reads back as 0, maxcnt evaluates to 0 and the maxcnt - 1 clamp wraps to 0xFFFFFFFF in u32. 4. The register only stores whole ticks, so the clamped ns value has to be converted to ticks and back. DIV_ROUND_CLOSEST() can round that conversion up past maxcnt: maxcnt = 640 ns, one tick = 666664 ps clamp: maxcnt - 1 = 639 ns ns -> ticks: 639000 / 666664 = 0.958 -> rounds to 1 tick tick -> ns: 1 * 666664 / 1000 = 667 ns 667 ns is programmed into RING_IDLEDLY, but 667 >= maxcnt (640), so xe_gt_WARN_ON() fires again on every subsequent init. Return early if timestamp_base is 0 (the unknown-crystal path). Do the conversions in u64 via the *_ULL() helpers so they cannot wrap. Clamp with a floor (DIV_ROUND_DOWN_ULL) so the programmed delay stays strictly below maxcnt, and guard the maxcnt == 0 case with a zero delay while still writing RING_IDLEDLY so INHIBIT_SWITCH_UNTIL_PREEMPTED is cleared. v2: Drop the redundant warn on the timestamp_base == 0 path; xe_gt_clock_init() already warns on an unrecognised crystal clock. Keep the early return to avoid the divide-by-zero. - Vinay v3: Field-mask the RING_IDLEDLY write with REG_FIELD_PREP(IDLE_DELAY, ...) instead of writing the raw tick count, which could clobber INHIBIT_SWITCH_UNTIL_PREEMPTED and reserved bits. Split the inhibit-switch clear from the maxcnt clamp so a set inhibit bit no longer forces a needless delay overwrite when the delay itself is already valid. Use gt_to_xe(gt) instead of gt_to_xe(hwe->gt). Fixes: d2de4410a88f ("drm/xe: Apply Wa_16023105232") Cc: stable@vger.kernel.org Assisted-by: GitHub_Copilot:claude-opus-4.8 Signed-off-by: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com> Reviewed-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com> Link: https://patch.msgid.link/20260916100545.779894-2-tilak.tirumalesh.tangudu@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit d864065ea25e9d12897c175de9176ce46677e176) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-09-22drm/xe: Limit sg segment size to PAGE_SIZE on Xen PVSzymon Acedański
Fix display corruption on Xen PV dom0, where DMA buffers are not guaranteed machine-contiguous, in which case bounce buffering kicks in, breaking xe's memory coherency assumptions. Apply the same workaround i915 carries in i915_sg_segment_size() since commit 78a07fe777c4 ("drm/i915: stop abusing swiotlb_max_segment"). Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8382 Link: https://lore.kernel.org/xen-devel/aYtznP_tT6xNPwf-@mail-itl/ Link: https://lore.kernel.org/all/20221020110308.1582518-1-hch@lst.de/ # i915 counterpart Cc: Christoph Hellwig <hch@lst.de> Cc: Robert Beckett <bob.beckett@collabora.com> Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Szymon Acedański <accek@invisiblethingslab.com> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/20260916173030.3223833-1-accek@invisiblethingslab.com (cherry picked from commit 77f704158f099b952681f207478a22d5b8218edb) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>