summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-10-07Revert "wifi: libertas: reject short monitor TX frames"Johannes Berg
This reverts commit 13ff543e0b2c713aedeaadadde686686e949dc78. The 'goto free' just made things worse, causing a spinlock to be handled incorrectly. Revert this for now. Reported-by: Takashi Iwai <tiwai@suse.de> Cc: stable@vger.kernel.org Fixes: 13ff543e0b2c ("wifi: libertas: reject short monitor TX frames") Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-10-07PCI: Avoid FLR and SBR on Intel DG1 0x4905 graphics adaptersJanusz Krzysztofik
DRM CI consistently reports failing device reset attempts on Intel DG1 discrete graphics adapters. Manual reproduction attempts allowed to narrow down the scope of that problem to a specific revision of that hardware, SKU 8086:4905. It has been confirmed that both reset methods claimed by the device, i.e., FLR and Secondary Bus Reset, suffer from that issue. Since consecutively failing device resets may lead to system hangs, disable both useless reset methods. A respective CI test will then be skipped instead of aborting whole CI jobs. Suggested-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/11814 Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com> Link: https://patch.msgid.link/20260907090249.1348552-2-janusz.krzysztofik@linux.intel.com
2026-10-07aoe: pull in the headers each received packet type readsJosef Bacik
aoenet_rcv() only pulls the AoE and ATA headers into the skb head when the packet is long enough to hold both. A shorter packet goes through unpulled, and aoenet_rcv() reads the AoE header from it anyway. CFG responses go on to aoecmd_cfg_rsp(), which reads the config header after it, and ATA responses get queued for ktiocomplete(), which skb_pull()s both headers. Ethernet pads frames to 60 bytes, so this mostly takes a virtual link, but nothing stops a short frame from getting here. Pull the AoE header up front and drop the packet if it isn't there, then pull the ATA or config header in the switch arm that hands the packet on, so each path gets the headers it reads. This also replaces the open-coded __pskb_pull_tail() with pskb_may_pull(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Josef Bacik <josef@toxicpanda.com> Link: https://patch.msgid.link/20261007-b4-aoe-short-packets-v1-1-db5155f7bb9c@toxicpanda.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-10-07drm/amdgpu: make Mac FB workaround genericAlex Deucher
Rather than adding a case of every chip where this is seen just check if the FB is at 0 and the ssid is apple. This should cover all chips which fall into this case. Tested-by: Ayhan Çiçek <ayhancicek@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit c54e4d10507722398dc90cf3c532e50b86cf425a) Cc: stable@vger.kernel.org
2026-10-07drm/amdkfd: fix dma_buf reference leak in get_dmabuf_infoHaojie Li
When kzalloc fails for metadata_buffer in amdgpu_amdkfd_get_dmabuf_info(), the function returns -ENOMEM directly without calling dma_buf_put(), leaking the dma_buf reference obtained earlier via dma_buf_get(). Fix both issues by: - Adding an error check after the first amdgpu_bo_get_metadata() call - Replacing the direct return with r = -ENOMEM and goto out_put to ensure dma_buf_put() is called on all error paths Fixes: f54ce9e8cbd3 ("drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl") Signed-off-by: Haojie Li <lihaojie@kylinos.cn> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ffa699553332f8caf8688d312279ddcea9e3c141) Cc: stable@vger.kernel.org
2026-10-07drm/amd/display: Don't replace a sink mode that shares the native totalsAdrian Betschart
decide_crtc_timing_for_drm_display_mode() copies the native mode's CRTC timing into the requested mode when clock, htotal and vtotal match. That is meant for the modes amdgpu inserts itself: amdgpu_dm_create_common_mode() duplicates the native mode and changes only hdisplay and vdisplay, so those are sent with the native timing and scaled. A sink can also offer a real mode with the same clock and totals as its native mode. CTA-861 VIC 102 (4096x2160@60) and VIC 97 (3840x2160@60) both use 594 MHz and 4400x2250. With 3840x2160@60 as the preferred mode, a 4096x2160@60 request goes out with the 3840x2160 timing and the framebuffer scaled into it (dst 3840x2025 at y=67), while the AVI InfoFrame still carries VIC 102. A JVC projector then reports 3840x2160 and shows a corrupted right edge. 4096x2160@24, whose totals differ, is sent and displayed correctly. Inserted modes keep the native sync positions; a real mode with its own active width does not. Compare those too, so only inserted modes are patched. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Signed-off-by: Adrian Betschart <adrian.betschart@cinemaone.ch> Assisted-by: Claude-Code:claude-opus-5-5 Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 22f9a2da101c37f821cd00954f81dc598754f4d5) Cc: stable@vger.kernel.org
2026-10-07drm/amdkfd: align SDMA doorbell base for shader doorbell writesSaleel Kudchadker
On GC 9.4.3, 9.4.4 and 9.5.0, doorbell writes issued from shaders are routed to an SDMA engine at 32-byte (4 doorbell index) granularity. SDMA engine doorbell ranges are 10 indices apart, so the range of every odd engine starts 2 indices into a 4-index block that begins in the previous engine's range. A shader ringing the doorbell of a queue on an odd engine therefore rings the previous engine instead. The intended queue never sees the doorbell, so its work stalls and the application hangs. Align the per-engine doorbell base up to a 4-index boundary on these ASICs. Each engine only uses 4 of its 10 indices, so the aligned base plus the queue offset stays within the engine's range. Even engines are already aligned, so only the doorbell IDs of odd-engine queues change. Only doorbells rung by the device itself are routed this way. Doorbell writes from the host, including the kernel's own SDMA rings, are not affected. The doorbell ID of an SDMA queue is saved in CRIU checkpoints and checked again on restore. A checkpoint taken before this change that contains an SDMA queue on an odd engine will fail to restore with -EINVAL. This is intentional: the restored process still holds the old doorbell address, so accepting the stale ID would bring back the same stall. Tested on MI300X with a shader-rung SDMA doorbell test: queues on odd engines hung before this change and complete with it. v2: use u32 instead of uint32_t for the new locals (checkpatch) v3: name the routing granularity, use dev->node_id, document the layout invariants, describe impact v4: express the granularity in doorbell indices, drop unrelated cleanups, explain the CRIU restore behavior, add test note Fixes: 6df442a03d1a ("drm/amdgpu: add new doorbell assignment table for aqua_vanjaram") Signed-off-by: Saleel Kudchadker <Saleel.Kudchadker@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ee1379e6d7da47bdf7a8d5b89c2d1b28473701fb) Cc: stable@vger.kernel.org
2026-10-07drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locksMikhail Gavrilov
Reading or writing a register through the amdgpu_regs2 debugfs file with GRBM bank selection, which umr does for every banked access (a single "umr -b x x x -r <reg>" is enough, as is the wave dump with "-O halt_waves"), makes lockdep report a circular locking dependency, after which lockdep stays off until reboot: WARNING: possible circular locking dependency detected umr/63306 is trying to acquire lock: ffff8882cf4b8350 (&mm->mmap_lock){++++}-{4:4}, at: __might_fault+0x9b/0x140 but task is already holding lock: ffff8881aec010d0 (&amdgpu_grbm_lock_key){+.+.}-{4:4}, at: amdgpu_debugfs_regs2_op.isra.0+0x20d/0xd00 [amdgpu] ... Chain exists of: &mm->mmap_lock --> &amdgpu_srbm_lock_key --> &amdgpu_grbm_lock_key ... __might_fault+0xc5/0x140 amdgpu_debugfs_regs2_op.isra.0+0x441/0xd00 [amdgpu] full_proxy_write+0x10e/0x1d0 vfs_write+0x1d0/0xf50 ksys_write+0x116/0x250 amdgpu_debugfs_regs2_op() and amdgpu_debugfs_process_reg_op() call get_user()/put_user() for every dword while holding grbm_idx_mutex or srbm_mutex, and pm.mutex if requested, so a fault there takes mmap_lock inside those locks. The lock hierarchy in amdgpu_lockdep.c puts srbm_mutex and grbm_idx_mutex below notifier_lock, which amdgpu_cs_submit() takes with the BO reservations held, and dma_resv_lockdep() orders the reservations inside mmap_lock. So mmap_lock is outside grbm_idx_mutex and srbm_mutex, and these two debugfs paths nest it the other way round. The copies under the locks are as old as the bank selection in both files; commit 1d0f5838b126 ("drm/amdgpu: Add lockdep annotations for lock ordering validation") only made them visible to lockdep. Copy the user buffer in before any of the locks is taken and the result out after all of them are dropped, as amdgpu_debugfs_wave_read(), amdgpu_debugfs_gpr_read() and amdgpu_debugfs_gprwave_read() already do. The buffer is sized by the count passed to read() or write(), so an access larger than PAGE_SIZE is now rejected with -EINVAL; umr reads and writes one register at a time. A fault on the user buffer of a write now fails with -EFAULT before any register is written, instead of after a partial write. Fixes: 566281595037 ("drm/amd/amdgpu: Add bank selection for MMIO debugfs (v3)") Fixes: 37df9560cd3e ("drm/amd/amdgpu: New debugfs interface for MMIO registers (v5)") Acked-by: Christian König <christian.koenig@amd.com> Acked-by: Tom St Denis <tom.stdenis@amd.com> Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ccf9e35ed6811f2c25ba6368e7dc6481da17159d) Cc: stable@vger.kernel.org
2026-10-07drm/amdgpu: serialize vblank counter reads against GPU resetVitaly Prosyak
The vblank counter callback reads display registers and scanout position without holding reset_domain->sem. During GPU recovery, display commit work can call the callback while reset owns the semaphore for writing. The hardware access then triggers the lockdep_assert_held() in amdgpu_device_skip_hw_access() and sets TAINT_WARN when lockdep is enabled. Try to acquire the reset semaphore for reading before accessing the hardware, and hold it across the counter and scanout-position reads. If reset is already in progress, return DRM's cached software vblank count instead. This avoids blocking behind reset and avoids accessing display hardware while it is being reset. The cached count is less accurate than the hardware count, but is used only when reset prevents a safe hardware read. This addresses the reset-time warning from this vblank path; it does not suppress or fix unrelated lockdep warnings. Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Harry Wentland <harry.wentland@amd.com> Cc: Sunpeng Li <sunpeng.li@amd.com> Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Reviewed-by: Sunpeng Li <sunpeng.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 51a4359f7431a4be5e42803c8bdaf7e0e5be2934) Cc: stable@vger.kernel.org
2026-10-07drm/amd/display: disable self-refresh on tearing flipsLeo Li
[Why & How] Immediate (tearing) flips breaks self refresh state machine assumptions, so disable PSR/Replay for them. Tested-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Leo Li <sunpeng.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit acbdd213b37e095f15685f3e3ee6d35defa05616) Cc: stable@vger.kernel.org
2026-10-07drm/amdgpu/userq: return the memdup_user() error for the user MQDJesse Zhang
mes_userq_mqd_create() returns -ENOMEM when copying the user MQD fails, even though memdup_user() returns -EFAULT for a bad pointer or -EINTR when interrupted by a signal. Return PTR_ERR() instead. While at it drop the error messages. Neither case is a driver error and userspace shouldn't be able to spam the log with invalid IOCTL parameters. v2: drop the error messages (Christian) Fixes: 2c695d7c0720 ("drm/amdgpu: enable compute/gfx usermode queue") Fixes: 543b61453774 ("drm/amdgpu: enable SDMA usermode queues") Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 49a443fcb829be9fc780f10850652ddea2fe81f0) Cc: stable@vger.kernel.org
2026-10-07drm/amdgpu/userq: only accept doorbell BOs as queue doorbellJesse Zhang
amdgpu_userq_get_doorbell_index() pins any BO passed as doorbell_handle into the doorbell domain. For a regular BO, TTM moves it with ttm_bo_move_null() and its contents are lost. Since an importer on the same device gets the exporter's GEM object, a client can do this to a buffer another client shared with it. Reject BOs that were not created in the doorbell domain. v2: drop the error message, use a local abo variable (Christian) Fixes: f09c1e6077ab ("drm/amdgpu: generate doorbell index for userqueue") Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f7497bbc19db4821c62b9d97b31c9086feb2d917) Cc: stable@vger.kernel.org
2026-10-07drm/amd/display: Fix direct scanout alpha on some DRM_FORMATsLeo Li
[Why] DM was declaring it's own list of has_alpha DRM formats to check against for enabling alpha blending, when the format->has_alpha already does that for us. The self-declared list missed some has_alpha formats, causing direct-scanout planes with such formats to appear opaque. [How] Drop the self-declared list, instead use the format->has_alpha field directly. Signed-off-by: Leo Li <sunpeng.li@amd.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 9ecdac91ed43d836683d5daa467f4907405420e2) Cc: stable@vger.kernel.org
2026-10-07drm/amdgpu: make Mac FB workaround genericAlex Deucher
Rather than adding a case of every chip where this is seen just check if the FB is at 0 and the ssid is apple. This should cover all chips which fall into this case. Tested-by: Ayhan Çiçek <ayhancicek@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amdkfd: fix dma_buf reference leak in get_dmabuf_infoHaojie Li
When kzalloc fails for metadata_buffer in amdgpu_amdkfd_get_dmabuf_info(), the function returns -ENOMEM directly without calling dma_buf_put(), leaking the dma_buf reference obtained earlier via dma_buf_get(). Fix both issues by: - Adding an error check after the first amdgpu_bo_get_metadata() call - Replacing the direct return with r = -ENOMEM and goto out_put to ensure dma_buf_put() is called on all error paths Fixes: f54ce9e8cbd3 ("drm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl") Signed-off-by: Haojie Li <lihaojie@kylinos.cn> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amdgpu: exclude npa_vmid from the userq vmids tooSunil Khatri
On IP_VERSION(12, 1, 0), we are excluding vmid 15 from the available vmids in kernel queues for mmhub but its not exluded from the userqueues mmhub vmids and it is a problem. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: only clear the hotplug sources the ASIC hasMattia Tadini
amdgpu_dm_hpd_init() clears every hotplug source in the enum before enabling the ones it needs: for (i = DC_IRQ_SOURCE_HPD1; i <= DC_IRQ_SOURCE_HPD6RX; i++) DC fills the unused slots of its interrupt table with dummy handlers that assert when touched, so on an ASIC with fewer than six HPD lines that sweep warns and taints the kernel. DCN 2.0.1 has two: mmHPD0_DC_HPD_INT_CONTROL and mmHPD1_DC_HPD_INT_CONTROL are the only hotplug registers in dcn_2_0_1_offset.h, against five in dcn_2_1_0_offset.h, and irq_service_dcn201.c defines hpd_int_entry(0) and (1) accordingly. On an AMD BC-250, which appears to be the only GPU using DCN 201, every boot produces this for sources 3 to 6: [drm] *ERROR* dal_irq_service_dummy_ack: called for non-implemented irq source, src_id=0, ext_id=0 [drm] dal_irq_service_set: src: 3, st: 0 WARNING: .../display/dc/irq/irq_service.c:129 at dal_irq_service_set.cold+0x2d/0x76 [amdgpu] dal_irq_service_set+0x4c/0x100 [amdgpu] amdgpu_dm_hpd_init.cold+0x15/0x12e [amdgpu] dm_hw_init+0x4c/0x170 [amdgpu] amdgpu_device_init.cold+0x1727/0x1ec0 [amdgpu] and the machine comes up tainted W, which makes every unrelated bug report from it harder to read. Walk the links this ASIC has instead of the whole enum, and skip a link with no hotplug line of its own, which is the same guard the enable loop further down already applies. A source owned by a real link is implemented by definition, so the dummy handlers are no longer reached. Parts with six HPD lines are unaffected. Signed-off-by: Mattia Tadini <info@mtsistemi.it> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Don't replace a sink mode that shares the native totalsAdrian Betschart
decide_crtc_timing_for_drm_display_mode() copies the native mode's CRTC timing into the requested mode when clock, htotal and vtotal match. That is meant for the modes amdgpu inserts itself: amdgpu_dm_create_common_mode() duplicates the native mode and changes only hdisplay and vdisplay, so those are sent with the native timing and scaled. A sink can also offer a real mode with the same clock and totals as its native mode. CTA-861 VIC 102 (4096x2160@60) and VIC 97 (3840x2160@60) both use 594 MHz and 4400x2250. With 3840x2160@60 as the preferred mode, a 4096x2160@60 request goes out with the 3840x2160 timing and the framebuffer scaled into it (dst 3840x2025 at y=67), while the AVI InfoFrame still carries VIC 102. A JVC projector then reports 3840x2160 and shows a corrupted right edge. 4096x2160@24, whose totals differ, is sent and displayed correctly. Inserted modes keep the native sync positions; a real mode with its own active width does not. Compare those too, so only inserted modes are patched. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Signed-off-by: Adrian Betschart <adrian.betschart@cinemaone.ch> Assisted-by: Claude-Code:claude-opus-5-5 Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amdgpu: Fix NPA-REVOKE racing an in-flight UALink importDavid Carlier
The exporter records an importer when it answers NPA-REQ, so it can send NPA-REVOKE as soon as the BO is freed, before the importer has finished building the dma-buf for that handle. The revoke handler assumes a fully imported node: it dereferences imp_xa_node->dmabuf, which is still NULL until the import completes, and drops the xarray reference the importing thread still relies on. The importer then links the node and marks it READY regardless, so the node can be freed while still on the per-remote list. Only tear down a node that is READY. A PENDING node is still being imported and nothing has been handed to user-space yet, so only mark it for teardown and send NPA-RELEASE. The importer checks for teardown under the xarray lock before linking the node and marking it READY, and unwinds otherwise. As NPA-REVOKE always follows NPA-RSP, a revoke that finds the node NOT_READY is stale, and one that finds it in teardown hits a node that is already being released, so both are ignored. Fixes: 7cc82cd90d35 ("drm/amdgpu: Implement mechanism to revoke exported memory") Assisted-by: LLM Signed-off-by: David Carlier <devnexen@gmail.com> Reviewed-by: Mukul Joshi <mukul.joshi@amd.com> Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: copy function name into dcn_optc_lock_unlock_state trace eventMelissa Wen
Userspace trace tools that use libtraceevent to read binary buffer only see a kernel address when printing const char *. Use string macros in dcn_optc_lock_unlock_state to copy the function name into the trace event. Fixes: f1943a51f0f9 ("drm/amd/display: Add events log to trace OPTC lock and unlock") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Melissa Wen <mwen@igalia.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: copy function name into dcn_fpu trace eventMelissa Wen
Userspace trace tools that use libtraceevent to read binary buffer only see a kernel address when printing const char *. Use string macros in dcn_fpu to copy the function name into the trace event. Fixes: 96ee63730fa3 ("drm/amd/display: Add control mechanism for FPU") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Melissa Wen <mwen@igalia.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: remove redundant cast on amdgpu_dc_reg_template printkMelissa Wen
Commit 0cf5eb76e2b4 ("drm/amd/display: Add tracing to dc") prints and casts uint32_t fields in amdgpu_dc_reg_template to unsigned long unnecessarily. Just print those fields with %08x and remove the redundant cast. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Melissa Wen <mwen@igalia.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: use right type for amdgpu_dc_performance event entriesMelissa Wen
Some amdgpu_dc_performance trace event params are passed as unsigned long but stored as uint32_t, cutting them off on 64-bit. Use the right type on entry fields and on printk use unsigned format accordingly. Fixes: 0cf5eb76e2b4 ("drm/amd/display: Add tracing to dc") Signed-off-by: Melissa Wen <mwen@igalia.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: declare amdgpu_dm_atomic_state_template as an event classMelissa Wen
Don't create an amdgpu_dm_atomic_state_template event since this is just a template. Declare the template as an event class that will be used by actual event tracers. Fixes: e8a982355f96 ("drm/amd/display: Add tracepoint for amdgpu_dm") Signed-off-by: Melissa Wen <mwen@igalia.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: fix vready offset assignment in dcn_optc_lock_unlock_stateMelissa Wen
vready_offset is captured by optc_state, but the trace point entry is wrongly assigned to vupdate_offset. Fix vready_offset tracepoint field in dcn_optc_lock_unloack_state to record optc_state->vready_offset. Fixes: f1943a51f0f9 ("drm/amd/display: Add events log to trace OPTC lock and unlock") Signed-off-by: Melissa Wen <mwen@igalia.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: remove duplicated prev_p_state_change_support assignmentMelissa Wen
The prev_p_state_change_support trace entry is assigned and printed twice, remove the unnecessary duplicates. Fixes: 13b5ca42ca9c ("drm/amd/display: Add tracepoint for capturing clocks state") Signed-off-by: Melissa Wen <mwen@igalia.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: assign missing trace entry in amdgpu_dm_dc_clocks_stateMelissa Wen
disp_dpp_voltage_level_khz is declared and printed, but never assigned. So when using clock tracepoint the value of this clock is just garbage. Assign clk->disp_dpp_voltage_level_khz since this is stored in dc_clocks as other entries. Fixes: 13b5ca42ca9c ("drm/amd/display: Add tracepoint for capturing clocks state") Signed-off-by: Melissa Wen <mwen@igalia.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Promote DC to 3.2.401Ashwin Santhosh
This version brings along the following updates: - Add HDMI RR and SCDC skips. - Add debug option to override low power SR latencies. - Allow skipping link bandwidth clear. - Handle virtual link encoder. - Improve MCM shaper/3DLUT programming and DTN logging. - Only reprogram DRR when v_total values change. - Refactor DMUB fast lock sequencing. - Send HDMI VRR metadata in VTEM info packet slot. - Set cursor_offload for all pipes for a given stream. - Skip link off frame count for general UI. - Update link training no timeout behaviour on HDMI. Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ashwin Santhosh <Ashwin.Santhosh@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Send HDMI VRR metadata in VTEM info packet slotIvan Lipski
[Why] Brief blank on HDMI each time VRR engaged and disengaged, with no modeset at either transition. amdgpu_dm_update_freesync_state_on_stream() built the VTEM on top of the buffer holding the AMD FreeSync SPD payload, which becomes stream->vrr_infopacket. DC routes that to HDMI generic slot 3 (SPD) and vtem_infopacket to slot 6 (VTEM), and vtem_infopacket was never populated. So slot 3 carried a VTEM payload the sink parsed as an SPD InfoFrame, no VTEM was sent, and v_total varied with no valid metadata describing it. DP uses the VSC/AS-SDP path and is unaffected. [How] Build the VTEM into a separate vtem_infopacket, gated on the sink not advertising AMD FreeSync. Track it in dm_crtc_state, include it in the freesync_vrr_info_changed comparison and the reset path, and pass it through bundle->stream_update.vtem_infopacket. Reviewed-by: Jerry Zuo <jerry.zuo@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Add debug option to override low power SR latenciesAlvin Lee
[Description] - Add debug options to override low power SR latencies - Match regular SR latency debug override Reviewed-by: Austin Zheng <austin.zheng@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Add dcn42b project idDillon Varone
[WHY&HOW] Add project ID to distinguish dcn42b from dcn42. Reviewed-by: Austin Zheng <austin.zheng@amd.com> Signed-off-by: Dillon Varone <Dillon.Varone@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Handle virtual link encoderSridevi Arvindekar
[Why/How] Fix check for virtual link encoder Reviewed-by: Ilya Bakoulin <ilya.bakoulin@amd.com> Signed-off-by: Sridevi Arvindekar <sridevi.arvindekar@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Revert "avoid to write signal specific for tmds"Joshua Aberback
This reverts commit 93179870ae52d1663080655fb8f0170a82cf9951. The change regressed HDMI output on the TMDS-to-FRL switch. Reviewed-by: Martin Leung <martin.leung@amd.com> Signed-off-by: Joshua Aberback <joshua.aberback@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Update link training no timeout behaviour on HDMIRelja Vojvodic
[Why & How] - HMDI link training compliance testing fails when no timeout bit is set - Update condition to skip some link training logic when no timeout is set Reviewed-by: Chris Park <chris.park@amd.com> Signed-off-by: Relja Vojvodic <Relja.Vojvodic@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Assign alt wa bit in fams2 cmdAlvin Lee
[Description] Assign the workaround bit to ensure it propagates to FW Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Prepare DSC configuration before BLS executionRafal Ostrowski
[Why] DSC sequence operations calculated configuration during execution and passed OPTC outputs through pointers into other sequence steps. This coupled consumers to step storage and mixed calculation with programming. [How] Merge the DSC configuration operations into DSC_SET_CONFIG. Prepare register values in each DSC instance during build and pass OPTC values by value to timing-generator and stream-encoder operations. Share stream composition while preserving link-update and ODM padding. Use the correct DCN401 preparation callback and remove the legacy ops. Validate local composition inputs and capacity, stop immediate programming on preparation failure, and publish prepared caches only on success. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Reviewed-by: Chris Park <chris.park@amd.com> Signed-off-by: Rafal Ostrowski <rafal.ostrowski@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: allow skipping link bandwidth clearMartin Tsai
[why] To set link bandwidth with zero could hit error protection from Sink panel to fail link training and cause screen corruption. [how] To skip link bw cleaning in two conditions: 1. eDP v1.5 or latter, because the last write will take effect. 2. Sink requires not to clear it. Reviewed-by: Anthony Koo <anthony.koo@amd.com> Signed-off-by: Martin Tsai <Martin.Tsai@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Skip link off frame count for general UIAllen Li
[Why&How] To improve power saving of Replay, skip the link off frame count check for general UI in DC mode. Also disable timing sync in the same condition. Reviewed-by: ChunTao (Chun-Tao) Tso <chuntao.tso@amd.com> Signed-off-by: Allen Li <Allen.Li@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Refactor DMUB fast lock sequencingRafal Ostrowski
[WHY] Resolve fast-lock policy before execution and avoid queuing no-op steps. Remove duplicated per-ASIC command construction. [HOW] Use one fast-lock opcode, parameter structure and executor. Capture the service handle and precomputed Inbox0 command. Keep separate SubVP and generic capability hooks and preserve the lock manager's original support and split feature gates. Retain the unused SubVP enumerator and existing opcode values. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Rafal Ostrowski <rafal.ostrowski@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Set cursor_offload for all pipes for a given streamAlvin Lee
[Description] - When using the cursor offload path, the cursor_offload flag must be set for each DPP and HUBP driving the stream - Previous implementation only sets the flag in the DPP and HUBP for the OTG master pipe - Add helper function to populate an array of DPP's and HUBP's that need to have the cursor_offload flag set - This is to avoid passing in pipe_ctx to hwss execution params Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Signed-off-by: Alvin Lee <Alvin.Lee2@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: Add HDMI RR and SCDC skipsIlya Bakoulin
[Why/How] - Add debug key to avoid enabling RR by default. - Skip SCDC access if sink or SCDC cap not present Reviewed-by: Relja (Reggie) Vojvodic <relja.vojvodic@amd.com> Reviewed-by: Chris Park <chris.park@amd.com> Signed-off-by: Ilya Bakoulin <Ilya.Bakoulin@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: only reprogram DRR when v_total values changeAric Cyr
[Why] dc_stream_adjust_vmin_vmax() programmed the OTG on every call. FreeSync BTR calls it once per vblank, so identical v_total values were rewritten every frame, each one paying dc_exit_ips_for_hw_access() and, when FAMS is enabled, a blocking DMUB round trip from setup_manual_trigger(). [How] Return early when timing_adjust_pending is clear and every v_total field already matches the request, so hardware is only touched when the values change. stream->adjust is still updated on every path that continues, so a later commit programs the requested values. timing_adjust_pending is the existing "stream->adjust has not reached hardware" marker, so keep it accurate wherever hardware is left untouched: set_drr_and_clear_adjust_pending() now sets it when called with null params, which resets DRR in the OTG during pipe back-end teardown, and the max_v_total overflow path only clears it when set_long_vtotal() runs. Reviewed-by: Josip Pavic <josip.pavic@amd.com> Signed-off-by: Aric Cyr <Aric.Cyr@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: log MCM shaper and 3D LUT mode in the DTN logHarry Wentland
On DCN4 the per-plane MCM shaper and 3D LUT state wasn't visible in the DTN log: dcn401 wired read_mpcc_state to mpc1_read_mpcc_state, which only reads the base MPCC blend registers, and the MPCC section didn't print the LUT fields even where they were populated. Add mpc401_read_mpcc_state to also read MPCC_MCM_3DLUT_MODE (mode current and size) and MPCC_MCM_SHAPER_CONTROL (mode current), and print SHAPER, 3DLUT and 3DLUT_SIZE columns in the MPCC section. Mode is 0 bypass, 1 RAM_A, 2 RAM_B; 3DLUT_SIZE is 0 for 17x17x17 and 1 for 9x9x9. Assisted-by: Copilot:claude-opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amd/display: enable shaper when programming 3DLUTHarry Wentland
The plane-XR30-XR30-3dlut_17_12_rgb kms_colorop test fails on DCN 4.x. We need to make sure we set shaper_enable to enable the shaper block, otherwise the 3DLUT block will stay inactive. Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Roman Li <roman.li@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amdkfd: align SDMA doorbell base for shader doorbell writesSaleel Kudchadker
On GC 9.4.3, 9.4.4 and 9.5.0, doorbell writes issued from shaders are routed to an SDMA engine at 32-byte (4 doorbell index) granularity. SDMA engine doorbell ranges are 10 indices apart, so the range of every odd engine starts 2 indices into a 4-index block that begins in the previous engine's range. A shader ringing the doorbell of a queue on an odd engine therefore rings the previous engine instead. The intended queue never sees the doorbell, so its work stalls and the application hangs. Align the per-engine doorbell base up to a 4-index boundary on these ASICs. Each engine only uses 4 of its 10 indices, so the aligned base plus the queue offset stays within the engine's range. Even engines are already aligned, so only the doorbell IDs of odd-engine queues change. Only doorbells rung by the device itself are routed this way. Doorbell writes from the host, including the kernel's own SDMA rings, are not affected. The doorbell ID of an SDMA queue is saved in CRIU checkpoints and checked again on restore. A checkpoint taken before this change that contains an SDMA queue on an odd engine will fail to restore with -EINVAL. This is intentional: the restored process still holds the old doorbell address, so accepting the stale ID would bring back the same stall. Tested on MI300X with a shader-rung SDMA doorbell test: queues on odd engines hung before this change and complete with it. v2: use u32 instead of uint32_t for the new locals (checkpatch) v3: name the routing granularity, use dev->node_id, document the layout invariants, describe impact v4: express the granularity in doorbell indices, drop unrelated cleanups, explain the CRIU restore behavior, add test note Fixes: 6df442a03d1a ("drm/amdgpu: add new doorbell assignment table for aqua_vanjaram") Signed-off-by: Saleel Kudchadker <Saleel.Kudchadker@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amdkfd: mark A+A VF VRAM PTEs as system memoryZhigang Luo
On the A+A VF, VRAM is accessed through the system memory path, so SVM range PTEs that point at VRAM need AMDGPU_PTE_SYSTEM set, matching what the graphics paths already do. v2: - Use (sriov_vf || passthrough) and amdgpu_virt_vram_is_spm() for SVM VRAM PTE_SYSTEM. v3: - Rely on amdgpu_virt_vram_is_spm() without redundant VF/passthrough checks. Signed-off-by: Zhigang Luo <zhigang.luo@amd.com> Signed-off-by: Fangsheng Huang <Fangsheng.Huang@amd.com> Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com> Reviewed-by: Philip Yang <philip.yang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amdgpu: get rid of amdgpu_drm_ioctlPierre-Eric Pelloux-Prayer
Remove the entire amdgpu_drm_ioctl handler system in favor of drm_ioctl, as amdgpu_drm_ioctl held a runtime_pm reference for every ioctl that passed through it, even if hardware access was not required. The runtime_pm references should now be handled by each individual IOCTL that requires the GPU to be awake. Hopefully all the IOCTLs that require hardware access were covered. v2 (Shahyan): Added commit description Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amdgpu/gfx12: read xccs-per-xcp from RLC_IMU_AID_CONFIG for VFIYuBiao Wang
gfx_v12_1_get_xccs_per_xcp() supplies the compute partition layout that gfx_v12_1_cp_resume() needs on a VF. Once VFI is enabled the VF reaches registers through RLCG, which cannot access the GFX_IMU registers, so the GFX_IMU_PARTITION_SWITCH read stops working. Take the same field from RLC_IMU_AID_CONFIG instead, and read it with a direct MMIO access rather than RREG32_SOC15, which would route back into the RLCG path. Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locksMikhail Gavrilov
Reading or writing a register through the amdgpu_regs2 debugfs file with GRBM bank selection, which umr does for every banked access (a single "umr -b x x x -r <reg>" is enough, as is the wave dump with "-O halt_waves"), makes lockdep report a circular locking dependency, after which lockdep stays off until reboot: WARNING: possible circular locking dependency detected umr/63306 is trying to acquire lock: ffff8882cf4b8350 (&mm->mmap_lock){++++}-{4:4}, at: __might_fault+0x9b/0x140 but task is already holding lock: ffff8881aec010d0 (&amdgpu_grbm_lock_key){+.+.}-{4:4}, at: amdgpu_debugfs_regs2_op.isra.0+0x20d/0xd00 [amdgpu] ... Chain exists of: &mm->mmap_lock --> &amdgpu_srbm_lock_key --> &amdgpu_grbm_lock_key ... __might_fault+0xc5/0x140 amdgpu_debugfs_regs2_op.isra.0+0x441/0xd00 [amdgpu] full_proxy_write+0x10e/0x1d0 vfs_write+0x1d0/0xf50 ksys_write+0x116/0x250 amdgpu_debugfs_regs2_op() and amdgpu_debugfs_process_reg_op() call get_user()/put_user() for every dword while holding grbm_idx_mutex or srbm_mutex, and pm.mutex if requested, so a fault there takes mmap_lock inside those locks. The lock hierarchy in amdgpu_lockdep.c puts srbm_mutex and grbm_idx_mutex below notifier_lock, which amdgpu_cs_submit() takes with the BO reservations held, and dma_resv_lockdep() orders the reservations inside mmap_lock. So mmap_lock is outside grbm_idx_mutex and srbm_mutex, and these two debugfs paths nest it the other way round. The copies under the locks are as old as the bank selection in both files; commit 1d0f5838b126 ("drm/amdgpu: Add lockdep annotations for lock ordering validation") only made them visible to lockdep. Copy the user buffer in before any of the locks is taken and the result out after all of them are dropped, as amdgpu_debugfs_wave_read(), amdgpu_debugfs_gpr_read() and amdgpu_debugfs_gprwave_read() already do. The buffer is sized by the count passed to read() or write(), so an access larger than PAGE_SIZE is now rejected with -EINVAL; umr reads and writes one register at a time. A fault on the user buffer of a write now fails with -EFAULT before any register is written, instead of after a partial write. Fixes: 566281595037 ("drm/amd/amdgpu: Add bank selection for MMIO debugfs (v3)") Fixes: 37df9560cd3e ("drm/amd/amdgpu: New debugfs interface for MMIO registers (v5)") Acked-by: Christian König <christian.koenig@amd.com> Acked-by: Tom St Denis <tom.stdenis@amd.com> Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-07drm/amdgpu: serialize vblank counter reads against GPU resetVitaly Prosyak
The vblank counter callback reads display registers and scanout position without holding reset_domain->sem. During GPU recovery, display commit work can call the callback while reset owns the semaphore for writing. The hardware access then triggers the lockdep_assert_held() in amdgpu_device_skip_hw_access() and sets TAINT_WARN when lockdep is enabled. Try to acquire the reset semaphore for reading before accessing the hardware, and hold it across the counter and scanout-position reads. If reset is already in progress, return DRM's cached software vblank count instead. This avoids blocking behind reset and avoids accessing display hardware while it is being reset. The cached count is less accurate than the hardware count, but is used only when reset prevents a safe hardware read. This addresses the reset-time warning from this vblank path; it does not suppress or fix unrelated lockdep warnings. Cc: Christian König <christian.koenig@amd.com> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Harry Wentland <harry.wentland@amd.com> Cc: Sunpeng Li <sunpeng.li@amd.com> Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Reviewed-by: Sunpeng Li <sunpeng.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>