summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/xe
AgeCommit message (Collapse)Author
6 daysMerge tag 'platform-drivers-x86-v7.4-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: "The usual updates for laptop quirks from HP, ASUS, Acer, Dell etc: - new model names and recent CPU support - more special button / function key handling - battery and hardware monitoring quirks Tool updates to intel-speed-select WMI now supports non-x86 architectures Miscellaneous cleanups / refactoring / improvements" * tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (237 commits) platform/x86: asus-wmi: name the TUF keyboard RGB state and speed codes platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming platform/x86: asus-wmi: rename TUF RGB state DEVID to _CMD platform/x86: asus-armoury: add power limits quirk for GU605CM platform/x86: asus-armoury: add power limits quirk for G533QS platform/x86: asus-armoury: add power limits quirk for GA402NV platform/x86: asus-armoury: add power limits quirk for FA608UP platform/x86: asus-armoury: add power limits quirk for FA608UH platform/x86: asus-armoury: add power limits quirk for FA608PM platform/x86: asus-armoury: add power limits quirk for G713QR platform/x86: ibm_rtl: Fix potential OOB read at signature search platform/x86: acer-wmi: Add support for Acer Nitro AN16-41 platform/x86: acer-wmi: Cycle platform profile on mode key 0x4 platform/x86: hp-wmi: Disable hwmon attributes when no fans are usable platform/x86: gpd pocket fan: Cancel work before releasing GPIOs platform/x86: asus-armoury: Add XBOX ROG Ally X 20 Tunables platform/x86: msi-wmi: Ignore WMI events for keys also handled by atkbd platform/x86: msi-wmi: Sort scancodes numerically platform: arm64: Add a driver for the EC found on ASUS Glymur machines MAINTAINERS: Add myself as a LENOVO drivers co-maintainer ...
10 daysMerge tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm updates from Dave Airlie: "Highlights: - core: a lot of atomic refactoring in progress, panic got split into a core/helpers model - amdgpu: enables HDMI 2.1 FRL and other good things finally, UAlink over Ethernet support - xe: has a bunch of CRI support, ras error for bad vram, memory offlining support. - msm: enables a bunch more GPUs. Otherwise it's a the usual mountain of stuff all over the place. Details: rust: - I/O tree shared with driver-core - DMA tree shared with driver-core - allow aux registration data closures to return covariant sub-fields - Implement Send and Sync for MapleTree - add pci resource flags and IORESOURCE_MEM_64 drm/rust: - add dma_fence abstraction - init DRM registrations and their data in place - drop unused flags argument to registration vgaarb: - rework API to pass a private ptr instead of pci device sound: - adapt to omapdrm changes gem: - add callback for handle count going to 0 gpusvm: - share one HMM fault and keep single mappings inline pagemap: - Prevent CPU stalls during unbounded pagemap teardown dma-fence: - fix docs vga_switcheroo: - disconnect from fbcon - update fbcon from within fbdev emulation atomic: - move DRM from state reset callbacks to atomic_create_state - remove drm_simple_encoder_init panic: - split into core and helpers buddy: - improve dirty tracking clients: - improve vmap handling - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko display: - export HDMI SCDC status data via debugfs - rework SCDC for better HDMI 2.0 support - dp/mst: improve DPCD compliance edid: - parse AMD VSDB - parse ALLM/VRR capabilities - support detecting panel size log: - add drm_warn_ratelimited sched: - cleanup interface - add missing locking - fix run-queue cleanup - fix locking sysfb: - remove obsolete quirk for Lenovo D330 - fix panel orientation for non-native display modes - drop drm_class_device_register colorop: - provide DRM_COLOR_OP_FIXED_MATRIX bridge: - analogix: Support eDP lane mapping - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84 - Select DRM_PANEL_BRIDGE for various drivers that require it - add chrontel ch7218a support panel: - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001 - samsung-s6d16d0: Use mipi_dsi_*_multi() functions - support Ilitek ILI7836A OLED plus DT bindings - support Novatek NT36532 plus DT bindings - convert several drivers to managed cleanup - fix Kconfig selections - edp: - Add support for BOE NV140FHM-T0A - Support CSOT MNE007QB1-1 - NV140WU2-M70 - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization - samsung: Share test-key helpers - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE DV215FHM-R01 plus DT bindings - Refactor struct drm_panel to contain struct drm_bridge plus fallout in various panel drivers - Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO B140HAN04.0, AUO 0x0db3, panels. amdgpu: - use AMD VSDB for freesync - implement YUV-to-RGB with fixed-matrix colorop - enable FRL for HDMI - HDMI 2.1 freesync support - HDMI 2.1 ALLM support - HDMI 2.1 VRR support - UALoE (UALink over Ethernet) support - add syncobj_points to userq signal ioctl - drop unused kunit tests - NBIO/GC/MMHUB/SMU updates/fixes - GPU spatial partitioning updates - display kunit fixes - userq fixes - RGB quantization fixes - DC RMCM refactor - DP MST fixes - USB4 fixes - add new trace events - Rework display instance handling - stack frame size fixes for various compilers/configs - VCN 4/5 reset fixes - freesync updates - cursor refactor - Fix direct scanout alpha on some DRM_FORMATs - Expand Mac reserved memory workaround - Make runtime pm more fine grained amdkfd: - updates and fixes - GC 10 CU occupancy support radeon: - eDP fix for DCE3.2 iMacs xe: - add drm_ras netlink error event support - add memory page offlining support - introduce error threshold to drm_ras - fix stale GTT mappings on unmap - reject page faults for non-page fault mode scratch VM - enable CRI package and VRAM temperatures - introduce cold reset recovery - handle CRI+ power interval encoding - VF migration for multi-queue - handle exec queue teardown after hot unplug - alerts and controller enabling modifications - use IBCv3 on PTL - VRAM health check - report GT TDR and VM rebind faults using SIGID - add multi_queue_active_lrca debugfs - shrinker: Runtime PM reference for non-system memory - guc: Add simple KLV decoder helpers - debugfs: Expose per-engine idle status - Keep walking on SVM eviction failure - Nuke PTs only after unlinking contested VMAs - limit sg segment size to PAGE_SIZE on Xen PV - keep VF LMEM bar size low if no VFs - CPU binds and ULLS on migration queue - New PTL PCI ID - Enable PXP for NVL-S - Do not dma_fence_put zero fences in err_out path - Refresh TTM LRU on SVM prefetch - export device UID in sysfs i915: - rename GEN6_PCODE_DATA to match spec - fix incorrect RCU teardown order - fix potential UAF in command parsing - avoid WARN splat during RPS boosting race - use simpler min functions - Fixes to make i915 work well with PREEMPT_RT i915/display: - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path - Switch DG2 MPLL to DPLL framework - DP-HDMI PCON DSC fixes - limit invalid joiner combinations - CDCLK related fixes and refactor around PCODE integration - Gate UHBR SST SDP splitting on sink caps - add HDMI TMDS audio bandwidth check - vswing/preemph override - enable AS SDP Skip frames - Handle negative configuration index on DP link caps for robustness - Preparation for enabling SDR plane color pipeline - An eDP quirk for HP Pavilion Plus - Introduce PME (Power Management Event) support on display hotplug - Handle VSC SDP revision 7 in unpack msm: - CI: - Dropped sc7180 trogdor lazor from the CI - Core: - Fixed msm_ioremap for resources without a name - Changed msm.separate_gpu_kms to default to auto selection - GPU: - Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding limits on CX/GX rails - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85 (Mahua) - Fix VBIF halt mask on a306, which was preventing runpm suspend - Enable THP support for GEM buffers - Add modparam to disable waiting on fences in shrinker - Drop use of drm_prime_sg_to_page_array() - a5xx: don't read the GPMU registers on GPUs without a GPMU - a2xx/a3xx/a5xx: hangcheck progress detection - a6xx: gmuwrapper runpm fix - Calculate reported GMEM size based on active slices - Split a6xx/a7xx/a8xx catalog - DP: - Picked up some preparation patches for the MST support - Fixed reported status of the link training - DPU: - Fixed CRTC bandwidth computation - Fixed DSC programming - Fixed encoder disablement path - DSI: - Fixed VM leak in error path - Indention fix - MDP5: - Added MSM8952 configuration - Dropped incorrect cursor pipe on MSM8976/56 - HDMI: - Small fixes nouveau: - improve runtime PM on R570 GSP firmware - various fixes throughout the driver - dispnv50: support 2.147 GHz pixel clock in GB20x nova: - add initial uapi concept - add initial PRAMIN access support - add GpuMm centralized memory manager - add GPU VM and BAR1 support - add GPU interrupts and GSP events support - GSP messaging fixes tyr: - use bitfield! - zero unsupported and newly added GPU info fields - limit doorbell array to 17 entries exynos: - FIMD fixes - Fix clock leak on resume error path - Fix Sparse warnings by adding missing __iomem annotation - VIDI cleanup - Replace kmalloc() and copy_from_user() with memdup_user() amdxdna: - fix BO handling - Support AIE2 rev 9 - Fix UAF access in scheduler fences - Update workqueue interface - expose busy time via fdinfo ast: - support 256-byte EDID hyperv_drm: - remove support for pre win10 hosts komeda: - fix GLB_CORE_ID usage omap: - report HDMI hotplug events to ASoC HDMI codec panthor: - provide gpu_cache_flush tracepoint - improve dma_fence signalling latency - improve locking - export scheduling information via debugfs - Validate user-space input against firmware limits qaic: - reject BOs that exceed maximum page count - add missing include statements verisilicon: - fix hardware cursor offsets vkms: - implement YUV-to-RGB with fixed-matrix colorop gma500: - avoid unsupported ARGB formats in primary plane hibmc: - handle vblank interrupts correctly ivpu: - add DRM_IVPU_CAP_CMDQ_SET_PRIORITY - support command-queue priority ioctl - Simplify NULL-pointer handling in cleanup code arcpgu: - replace simple-display pipeline with regular atomic helpers aspeed: - replace simple-display pipeline with regular atomic helpers gm12u320: - replace simple-display pipeline with regular atomic helpers imagination: - various improvement to firmware interaction - add job to pvr_job_submit_fw trace event mali-dp: - fix runtime PM leak mcde: - replace simple-display pipeline with regular atomic helpers p111: - replace simple-display pipeline with regular atomic helpers - drop unsupported alpha formats from primary plane rcar-du: - support Renesas R-Car V4H DSC - dsi: Support larger transfers with AXI memory - Support RZ/G3L SoC repaper: - replace simple-display pipeline with regular atomic helpers rockchip: - dsi: improve PHY timings ssd130x: - support Solomon SSD1351 OLED plus DT bindings - ssd133x: upgrade color format to RGB565 - ssd132x: Set correct hardware window when clearing screen tve200: - replace simple-display pipeline with regular atomic helpers xen: - replace simple-display pipeline with regular atomic helpers v3d: - improve job handling under perfmon vc4: - reliably reset V3D - drop brcm,vc4-v3d compatible virtio: - fix damage handling - Support ARGB8888 for virtio primary planes. host1x: - Support partitioning imx: - Replace simple-display with regular atomic helpers mxsfb: - Support bus formats plus DT bindings tegra: - improve syncobj handling on submit panfrost: - add Mali-G68 support - improve GPU reset handling rockchip: - add HDMI 2.0 support to dw-hdmi-qp - improve HPD handling" * tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel: (2324 commits) drm/adp: Switch to drm_atomic_helper_connector_create_state drm/malidp: Convert to atomic_create_state drm/vc4: Switch to drm_atomic_helper_connector_create_state drm/sysfb: Switch to drm_atomic_helper_connector_create_state drm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_state drm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_state drm/hyperv: Switch to drm_atomic_helper_connector_create_state drm/bridge: megachips: Switch to drm_atomic_helper_connector_create_state drm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_state drm/arm: komeda: Switch to drm_atomic_helper_connector_create_state drm/appletbdrm: Fix incorrect error message on encoder attach failure drm/sun4i: hdmi: Convert to drmm_connector_hdmi_init() drm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilities drm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilities drm/bridge: ite-it66121: Advertise HDMI 1.2 capabilities drm/bridge: ite-it6263: Advertise HDMI 1.3 capabilities drm/bridge: ite-it6263: Drop redundant .mode_valid hook drm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilities drm/bridge: adv7511: Advertise HDMI 1.2 capabilities drm/sched: Document entity->stopped is protected by entity->lock ...
11 daysMerge tag 'modules-7.4-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Petr Pavlu: - Ignore local labels and mapping symbols during module load These symbols were already ignored during kallsyms address-to-symbol lookups. Filter them out earlier during module loading to reduce lookup overhead and prevent them from appearing in /proc/kallsyms. - Fix potentially incorrect access of SetOnce<T> when setting Rust module parameters. - Fix a potential read of an uninitialized count when printing taint information for unloaded modules. - Allocate the kmod argument array using kmalloc_array() in preparation for conversion to type-aware allocators. - Clean up includes in linux/kmod.h Add explicit includes of linux/umh.h to files that use usermode helpers. Then clean up the #include list in linux/kmod.h, notably removing the compatibility linux/umh.h include. - Remove the error-injection.h include from linux/module.h Add explicit includes of linux/error-injection.h to files that use the ALLOW_ERROR_INJECTION() macro and currently rely on it being provided indirectly via linux/module.h. Then remove the unnecessary linux/error-injection.h include from linux/module.h. - Replace __MODULE_STRING() with __stringify() in various drivers in preparation for removing the former macro. * tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: drivers: Replace __MODULE_STRING() with __stringify() module: Fix uninitialized count read of unloaded taint tracking record rust: module_param: Fix potentially incorrect access of `SetOnce<T>` module: Remove the error-injection.h include from linux/module.h drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION() drm/i915: Include error-injection.h for ALLOW_ERROR_INJECTION() syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION() net: Include error-injection.h for ALLOW_ERROR_INJECTION() block: Include error-injection.h for ALLOW_ERROR_INJECTION() module: Bring includes in linux/kmod.h up to date time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ... umh, treewide: Explicitly include linux/umh.h where needed modules/kmod: Allocate argv with kmalloc_array() module/kallsyms: Ignore local labels and mapping symbols during module load module/kallsyms: Refactor current symbol filtering into is_core_symbol() module/kallsyms: Rename is_mapping_symbol() to is_ignored_kernel_symbol()
13 daysMerge tag 'configfs-7.4-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux Pull configfs updates from Breno Leitao: - Attribute structures can now be const (Thomas Weißschuh) - The first selftests for the configfs userspace interface, plus a sample subsystem that accepts symlinks to test against. They include a race of symlink(2) against rmdir of the target, which exercises the use-after-free fixed in v7.3-rc3. - Rust bindings, merged from Andreas Hindborg's signed tag: fix the data offset calculation in subsystem callbacks (marked for stable), add the missing Send and Sync bounds, and correct a safety comment. * tag 'configfs-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux: samples: configfs: constify the configfs_attribute structures configfs: Allow the registration of const struct configfs_attribute configfs: Constify configfs_bin_attribute configfs: Treat attribute structures as const internally configfs: Constify is_visible/is_visible_bin in configfs_group_operations rust: configfs: remove mutability from some field initializers selftests/configfs: race symlink against rmdir of the target selftests/configfs: cover symlink and unlink samples/configfs: add a subsystem that accepts symlinks selftests/configfs: add tests for the userspace interface rust: configfs: fix data offset calculation for subsystem callbacks rust: configfs: require thread-safe callback data rust: configfs: fix release safety documentation
2026-10-16configfs: Constify is_visible/is_visible_bin in configfs_group_operationsThomas Weißschuh
These callbacks are never meant to modify their configfs_attribute structure. Enforce this in the type system. As there are only two implementers of these callbacks, adapt them right away, avoiding a phased transition. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Reviewed-by: Breno Leitao <leitao@debian.org> Acked-by: Andreas Hindborg <a.hindborg@kernel.org> Link: https://patch.msgid.link/20260716-configfs-const-base-v1-2-c545a4053cb5@weissschuh.net Signed-off-by: Breno Leitao <leitao@debian.org>
2026-10-13drm/xe: Bump LRU for external objects on exec and rebindThomas Hellström
The VM's private BOs get their LRU position refreshed in bulk via ttm_lru_bulk_move_tail() on vm->lru_bulk_move, both after a successful non-LR exec and after the LR preempt-fence rebind worker runs. External objects (BOs potentially shared across VMs) are never added to that per-VM bulk move list, so their LRU position is never refreshed by either path. This makes external objects in active use look more evictable than they are. Add xe_vm_bump_lru(), which, under a single lru_lock critical section, performs the bulk move of the VM's private BOs and bumps each external object locked by the drm_exec transaction. Use it from both the non-LR exec path and the LR rebind worker, replacing the open-coded bulk move. Fixes: d490ecf57790 ("drm/xe: Rework xe_exec and the VM rebind worker to use the drm_exec helper") Cc: Matthew Auld <matthew.auld@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: <stable@vger.kernel.org> # v6.8+ Assisted-by: LLM Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20261012132607.21387-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 324ba30cca180c2e1d02090743dd78ccb15b9e4a) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-13drm/xe/oa: Zero OA buffer at allocationBommu Krishnaiah
ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents. Streams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OA buffer without calling xe_oa_init_oa_buffer(). Zero the buffer at allocation to prevent information disclosure through mmap. The existing zeroing in xe_oa_init_oa_buffer() remains necessary for zero report-id/timestamp detection on enable/re-enable. Fixes: 392bf22238ff ("drm/xe/oa/uapi: OA buffer mmap") Assisted-by: LLM Cc: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Cc: Ghimiray, Himal Prasad <himal.prasad.ghimiray@intel.com> Signed-off-by: Bommu Krishnaiah <krishnaiah.bommu@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com> Link: https://patch.msgid.link/20261006020314.2711762-1-krishnaiah.bommu@intel.com Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com> (cherry picked from commit 126c4c5388f9311a390b9b254a835b0cf0f55331) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-13drm/xe: skip eviction of a BO with no resourceNiranjana Vishwanathapura
xe_evict_flags() switches on tbo->resource->mem_type to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed during teardown while its attachment is still live: the exporter then invalidates it via xe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a NULL resource and faults. A BO with no resource has nothing placed or mapped, so there is nothing to evict. Return an empty placement (num_placement = 0), mirroring the handling already used for non-xe scatter-gather BOs just above; ttm_bo_validate() then takes the pipeline-gutting path and returns 0. Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource dynamic live selftest will fail with below stack. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:xe_evict_flags+0xf4/0x140 [xe] Call Trace: <TASK> xe_bo_evict+0x40/0xa0 [xe] ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm] xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe] xe_dma_buf_kunit+0x387/0x580 [xe] v2: Add Fixes tag and failure info in commit text (Matt Brost) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Assisted-by: GitHub-Copilot:claude-opus-4.8 Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com> Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com> Link: https://patch.msgid.link/20261012215014.1495677-5-niranjana.vishwanathapura@intel.com (cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-13ACPI: video: Remove CONFIG_X86 handling from nvidia_wmi_ec_supported()Armin Wolf
The WMI-ACPI driver now supports architectures other than x86. Remove the CONFIG_X86 handling from video-detect and the associated drivers to simplify the resulting code. Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Signed-off-by: Armin Wolf <W_Armin@gmx.de> Acked-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com> Link: https://patch.msgid.link/20260724025959.142826-3-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-10-12drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state changeThomas Hellström
Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on pin, and added back on unpin according to the bo's purgeable state at that time. However, xe_bo_set_purgeable_shrinker() unconditionally transfers pages between the shrinkable and purgeable counts. If the purgeable state of a pinned bo changes, for example by userspace madvising DONTNEED on a VMA of a bo that is also pinned as a scanout buffer, this underflows one count and, after unpin, leaves the other one permanently inflated. Only update the purgeable flag for pinned bos, and leave the page accounting to unpin. Fixes: 536a2ead3a8f ("drm/xe/bo: Add purgeable shrinker state helpers") Cc: Arvind Yadav <arvind.yadav@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: intel-xe@lists.freedesktop.org Cc: <stable@vger.kernel.org> # v7.1+ Assisted-by: LLM Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20261009070053.7790-1-thomas.hellstrom@linux.intel.com (cherry picked from commit afe6bc012034123fd838328668e609bf57e46bd3) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-09Merge tag 'drm-intel-next-2026-10-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next [airlied: add xe fixup] - Vswing / Pre-emphasis Override (Michal) - Enable AS SDP Skip Frames (Uma) - Handle negative configuration index on DP link caps for robustness (Luca) - Perform full wedge on display reset (Ville) - PSR related revert and fix (Nemesa) - Preparation for enabling SDR plane color pipeline (Chaitanya, Pranay) - An eDP quirk for HP Pavilion Plus (Ankit) - DP MST fixes (Imre) - General display fixes and small improvements (Jani, Lalit, Vinod, Sebastian) - Introduce PME (Power Management Event) support on display hotplug (Vinod) - Force eDP sink awake on dpcd init (Arun) - Stop using the configurable fence timeout and other cleanups (Jani) - Add support for Common SDP Transmission Line (Ankit, Arun) - Map AUX power domains to DC_off (Suraj) - Handle VSC SDP revision 7 in unpack (Juasheem) - Disable VRR DC balance by default (Mitul) - Switch to modern drm_dp_dpcd* accessors (Jani) - Lg DPCD access errors (Suraj) - Fixes to make i915 work well with PREEMPT_RT (Maarten, Sebastian) - Update the CMN_SDP_TL in fastset path (Ankit) - Use a shared gtt_view_types.h header (Jani) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/asAD6RRGxlbIPdhz@intel.com
2026-10-07drm/xe/i2c: cancel the client work on removeFan Wu
xe_i2c_notifier() stores the DesignWare adapter in i2c->adapter and schedules i2c->work when the adapter is registered under the xe I2C platform device, and xe_i2c_client_work() then instantiates the AMC client device on that adapter. xe_i2c_remove() tears down the AMC, unregisters the client devices, the bus notifier and the adapter platform device, but it never drains i2c->work. A work item that is still queued or running when the adapter is unregistered dereferences i2c->adapter in i2c_new_client_device() after platform_device_unregister() has released the adapter. The work item is also embedded in the devm-allocated struct xe_i2c, so a work item still queued after the drm device devm unwind frees that allocation runs its callback on freed memory. The bus notifier is the only thing that schedules this work, and it is unregistered after the client devices. An instance that is still queued when the teardown runs can therefore write i2c->client[XE_I2C_CLIENT_AMC] while the loop is unregistering and clearing the same array, and an AMC client it instantiates late is only cleaned up by the adapter's own child sweep in i2c_del_adapter(). Move bus_unregister_notifier() in front of the client teardown loop and cancel the work right after it, so no new instance can be scheduled and a queued instance is drained before the client array is touched. A running instance still finds a live adapter, since the adapter is unregistered later. Fixes: f0e53aadd702 ("drm/xe: Support for I2C attached MCUs") Link: https://lore.kernel.org/intel-xe/20260912085932.101598-1-fanwu01@zju.edu.cn/ Cc: stable@vger.kernel.org Assisted-by: LLM, in-house static analysis tool Co-developed-by: Song Li <songl@zju.edu.cn> Signed-off-by: Song Li <songl@zju.edu.cn> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260928013030.612592-1-fanwu01@zju.edu.cn Link: https://patch.msgid.link/20261006000413.318561-2-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> (cherry picked from commit a23f27d5ec11c3f418c5e5531eea34ccda2b5b20) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-06drm/xe/sysctrl: Fix mailbox header handlingMallesh Koujalagi
The mailbox header was defined as __le32, which required cpu_to_le32() and le32_to_cpu() conversions whenever it was write or read. These conversions are unnecessary because the header is always handled as a 32-bit value, not as raw bytes. It is written with xe_mmio_write32() and read with xe_mmio_read32(), which already handle any required byte-order conversion through the underlying writel()/readl() accessors. As a result, the header value is already in CPU byte order when used by the driver. Keeping the extra conversions had no effect on little-endian systems and could cause an incorrect on big-endian systems. So use u32 for the mailbox header and remove the unnecessary endianness conversions. Fixes: 1f95f618182b ("drm/xe/xe_sysctrl: Add System Controller mailbox communication support") Suggested-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Mallesh Koujalagi <mallesh.koujalagi@intel.com> Tested-by: Anoop Vijay <anoop.c.vijay@intel.com> Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com> Link: https://patch.msgid.link/20260924060900.146167-18-mallesh.koujalagi@intel.com (cherry picked from commit 5137b391599579371c32f555958d3cf55e19bd88) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-05drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpinThomas Hellström
xe_bo_pin_external() and xe_bo_unpin_external() maintain the bo's pinned_link list membership in xe->pinned.late.external, based on whether the current call is the outermost pin or the final unpin. However, the same external bo's pin_count can also be raised and lowered directly by __xe_pin_fb_vma()/__xe_unpin_fb_vma(), which pin the bo as a display scanout buffer without going through xe_bo_pin_external()/xe_bo_unpin_external() at all, and have no notion of, or ownership over, pinned_link. If a bo is pinned both externally (e.g. dma-buf export) and as an fb, and the external unpin happens first, xe_bo_unpin_external() correctly observes pin_count > 1 and leaves the bo on pinned_link. When the fb unpin later performs the true last unpin (pin_count 1 -> 0), it never touches pinned_link, leaving the bo linked on xe->pinned.late.external indefinitely. Once the bo is subsequently freed, this stale list entry points into freed memory, corrupting the list and risking a use-after-free the next time the list is walked or spliced. The backup object pin/unpin sites in xe_bo_notifier_prepare_pinned()/ xe_bo_notifier_unprepare_pinned() have the same bypass characteristic, though they never add their bo to a pinned list, so are not affected by this particular list-corruption issue. Move the pinned_link removal into xe_bo_account_unpin(), which already runs on every unpin path (kernel, external, framebuffer, backup object) right before the true 1 -> 0 pin_count transition. Since list_del_init() only operates on the node itself, this removal is list-agnostic and safe to perform regardless of which list (external or kernel_bo_present) the bo happens to be linked on, or which code path is performing the final unpin. Drop the now-redundant explicit list_del_init() calls in xe_bo_unpin_external() and xe_bo_unpin(). v2: - New patch v3: - Rebased on changes to previous patch. Fixes: 44e694958b95 ("drm/xe/display: Implement display support") Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: intel-xe@lists.freedesktop.org Cc: <stable@vger.kernel.org> # v6.8+ Reviewed-by: Matthew Auld <matthew.auld@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Assisted-by: LLM Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/20261002100830.12297-3-thomas.hellstrom@linux.intel.com (cherry picked from commit ca58d36a1f93af586ee93b340c9f9fd81312cc01) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-05drm/xe: Fix shrinker accounting double-subtraction on nested external pinsThomas Hellström
xe_bo_pin_external() and xe_bo_unpin_external() support nested pins, since the underlying ttm_bo_pin()/ttm_bo_unpin() maintain a pin_count refcount rather than a boolean. However, the shrinker accounting calls xe_ttm_tt_account_subtract() and xe_ttm_tt_account_add() are invoked unconditionally on every pin_external()/unpin_external() call, instead of only on the transition into and out of the pinned state. An external BO (dma-buf) can be pinned more than once while already pinned, for example when it has multiple attachments/importers, each independently calling xe_bo_pin_external(). Each such nested pin subtracts the BO's pages from the shrinker's accounting again, even though the BO's pages were already removed from consideration by the first pin. Symmetrically, each nested unpin adds them back again before the BO is actually unpinned. This desynchronizes the shrinker's page and object counts from reality, and since they are declared as signed long but interpreted as unsigned long in xe_shrinker_count(), the underflow can turn into an enormous shrinkable/purgeable page count, causing the shrinker to be invoked excessively under memory pressure. Guard the accounting calls with the same pin-count transition checks already used to guard the pinned_link list maintenance, so accounting is only updated on the outermost pin and the final unpin. While centralizing this logic into xe_bo_account_pin()/ xe_bo_account_unpin(), also close a second, related accounting gap affecting imported dma-bufs. For an imported bo's ttm_tt, xe's ttm_tt_populate hook (xe_ttm_tt_populate()) early-returns without calling xe_ttm_tt_account_add(), since TTM_TT_FLAG_EXTERNAL is set without TTM_TT_FLAG_EXTERNAL_MAPPABLE. However, TTM core's ttm_tt_populate() wrapper unconditionally marks the tt as populated on driver-hook success, so ttm_tt_is_populated() still reports true for it. xe_bo_account_pin()/xe_bo_account_unpin() trusted ttm_tt_is_populated() as a proxy for "these pages are accounted for by the shrinker", and would subtract/add pages for such a tt that were never added in the first place, again underflowing the shrinker's counts. This is reachable today via xe_bo_pin_external(), and would have become newly reachable via the fb-pin path once this patch routes __xe_pin_fb_vma() through xe_bo_pin_account() below, so fix it here rather than in a later patch, to avoid a commit in this series that introduces the regression before fixing it. Skip the accounting for imported bos, using the same EXTERNAL && !EXTERNAL_MAPPABLE test xe_ttm_tt_populate()/xe_ttm_tt_unpopulate() use to decide whether to act, via a new xe_ttm_bo_is_imported() helper (hoisted up from its only prior use site). v2: - Fix the critical issue caught by Sashiko AI review: the pin-count transition check introduced here was still bypassed by the fb-pin path (__xe_pin_fb_vma()/__xe_unpin_fb_vma()), which could leave a stale pinned_link entry and a permanent shrinker accounting leak when the fb-unpin performed the true last unpin. Addressed in a separate follow-up patch in this series rather than folded in here, since it is a distinct bug with its own Fixes: tag. - Drop the unneeded local "last_unpin" variable in xe_bo_unpin_external(), restoring the original inline bo->ttm.pin_count == 1 check; it was a no-op rename not used by any of the new accounting helpers, and was going to be deleted again by the follow-up patch anyway. v3: - Exclude imported dma-bufs from the pin/unpin shrinker accounting, fixing another underflow caught by Sashiko AI review. - Add a short comment on the backup-object pin site noting it's already populated/accounted at pin time, addressing (as a false-positive clarification, no code fix needed) a separate Medium-severity accounting-leak concern also caught by Sashiko AI review. Fixes: 00c8efc3180f ("drm/xe: Add a shrinker for xe bos") Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: intel-xe@lists.freedesktop.org Cc: <stable@vger.kernel.org> # v6.15+ Reviewed-by: Matthew Auld <matthew.auld@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Assisted-by: LLM Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/20261002100830.12297-2-thomas.hellstrom@linux.intel.com (cherry picked from commit 6a117a2bb7ca657e3a19f83f4c06265d38dee06c) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-05drm/xe: Do not emit Wa_16010904313 twiceTvrtko Ursulin
During development of commit e8372edec948 ("drm/xe/xelp: Implement Wa_16010904313") one of the interim patch versions contained an incorrect rebase on top of some upstream changes, which caused Wa_16010904313 to be emitted both from the indirect context and from the workaround batch buffer. As this workaround needs to be emitted from the indirect context for rcs and ccs, but from the workaround batch buffer for bcs, vcs and vecs, we need to pass the location as an input parameter to setup_timestamp_wa() so it can decide whether to emit itself or not. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Fixes: e8372edec948 ("drm/xe/xelp: Implement Wa_16010904313") Cc: Matt Roper <matthew.d.roper@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260925080016.64802-1-tvrtko.ursulin@igalia.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> [Rodrigo: small adjustments on commit message for check-patch] (cherry picked from commit 38631a7bce195b88814b93bf2b6d3e48c827fef2) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-05drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximumsAlan Previn
Check for overflow in udelay use in __xe_mmio_wait32 and avoid growing delays becoming intollerably large by capping the in-loop wait time. v7: - Change assisted-by to "LLM" (Rodrigo). - Move the max-wait macro to outside the function (Rodrigo). v6: - Fix commit message to remove items dropped in v5. Fix the use of MAX_UDELAY_MS for microsecond unit. (Shasiko review). v5: - Simplify: don't introduce additional redesign and use min_t with a backoff to cap wait. (Rodrigo). v4: - Simplify using poll_timeout_us and poll_timeout_us_atomic and update all callers to never use a param for atomic (Jani) v3: - Use div64_s64 kernel API for 32-bit vs 64-bit division. v2: - Fixed checkpatch failure. - Added helper for 64-bit DIV_ROUND_UP on 32-bit CPU (Shasiko review). Fixed bug max range in usleep_range(Shasiko review) Fixes: 5c09bd6ccd41 ("drm/xe/mmio: Move xe_mmio_wait32() to xe_mmio.c") Signed-off-by: Alan Previn <alan.previn.teres.alexis@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Assisted-by: LLM Link: https://patch.msgid.link/20260929192037.2233429-2-alan.previn.teres.alexis@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> (cherry picked from commit 70dab9ee7d620e6018a64798aed065d14e9baed1) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-03Merge tag 'drm-misc-next-2026-10-02' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.4: Cross-subsystem Changes: Documentation: - Fix indention in display-related DT bindings Core Changes: - Provide helpers for calculating absolute and relative timeouts clients: - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko display: - dp/mst: Improve DPCD compliance sched: - fix locking Driver changes: amdxdna: - Support AIE2 rev 9 - Fix UAF access in scheduler fences - Update workqueue interface bridge: - Select DRM_PANEL_BRIDGE for various drivers that require it host1x: - Support partitioning imagination - Clean up firmware interface imx: - Replace simple-display with regular atomic helpers ivpu: - Simplify NULL-pointer handling in cleanup code mxsfb: - Support bus formats plus DT bindings panel: - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization - edp: NV140WU2-M70 - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE DV215FHM-R01 plus DT bindings - Refactor struct drm_panel to contain struct drm_bridge plus fallout in various panel drivers panthor: - Validate user-space input against firmware limits renesas: - Support RZ/G3L SoC ssd130x: - ssd132x: Set correct hardware window when clearing screen host1x: - support partitioning panel: - fix fallout from bridge-related changes tegra: - improve syncobj handling on submit Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20261002120720.GA720384@linux.fritz.box
2026-10-02Merge tag 'drm-xe-next-2026-10-01' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - New sysfs to expose device UID (Badal) Driver Changes: - Nuke PTs only after unlinking contested VMAs (Auld) - Limit sg segment size to PAGE_SIZE on Xen PV (Szymon) - Move locking to xe_sriov_pf_reprovision_default (Michal) - New workarounds (Tilak, Tales, Daniel) - Keep VF LMEM BAR size low if no VFs enabled (Marcin) - Drop ratelimiting from dev_unhold_work debug trace (Varun) - System Controller's Maibox response improvement (Anoop) - General clean-ups (Roper, Lin) - Revert "drm/xe: Set mask bits for CCS_MODE register" (Roper) - CPU binds and ULLS on migration queue (Brost) - Re-apply an i2c patch silently removed by a merge (Bartosz) - New PTL PCI ID (Atwood) - Enable PXP for NVL-S (Alan) - Let xe_guc_ct_send_locked() callers reserve G2H credit (Sujaritha) - Implement print vfunc for page fault info logging (Brian) - Do not dma_fence_put zero fences in err_out path (Jonathan) - Add focused VM teardown and page fault tracing (Daniel) - Fix ULLS chained job loss and GT reset replay (Varun) - Refresh TTM LRU on SVM prefetch (Himal) - Fix xe_mmio_wait32() to honor delay/sleep maximums (Alan) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/ar5YsqAK3bS4Ta6Z@intel.com
2026-10-01drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION()Petr Pavlu
Several drivers/gpu/drm/xe/*.c files use ALLOW_ERROR_INJECTION(), which is defined in asm-generic/error-injection.h. They currently rely on this header being included indirectly through linux/module.h -> linux/error-injection.h. Add the missing includes in preparation for removing the linux/error-injection.h include from linux/module.h. Remove also the linux/fault-injection.h include, which commit 91b2c42c214f ("drm/xe: Use fault injection infrastructure to find issues at probe time") mistakenly used to provide the definition of ALLOW_ERROR_INJECTION(). Reviewed-by: Francois Dugast <francois.dugast@intel.com> Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
2026-10-01drm/xe/mmio: Fix xe_mmio_wait32() to honor delay/sleep maximumsAlan Previn
Check for overflow in udelay use in __xe_mmio_wait32 and avoid growing delays becoming intollerably large by capping the in-loop wait time. v7: - Change assisted-by to "LLM" (Rodrigo). - Move the max-wait macro to outside the function (Rodrigo). v6: - Fix commit message to remove items dropped in v5. Fix the use of MAX_UDELAY_MS for microsecond unit. (Shasiko review). v5: - Simplify: don't introduce additional redesign and use min_t with a backoff to cap wait. (Rodrigo). v4: - Simplify using poll_timeout_us and poll_timeout_us_atomic and update all callers to never use a param for atomic (Jani) v3: - Use div64_s64 kernel API for 32-bit vs 64-bit division. v2: - Fixed checkpatch failure. - Added helper for 64-bit DIV_ROUND_UP on 32-bit CPU (Shasiko review). Fixed bug max range in usleep_range(Shasiko review) Fixes: 5c09bd6ccd41 ("drm/xe/mmio: Move xe_mmio_wait32() to xe_mmio.c") Signed-off-by: Alan Previn <alan.previn.teres.alexis@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Assisted-by: LLM Link: https://patch.msgid.link/20260929192037.2233429-2-alan.previn.teres.alexis@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe: Bump prefetch BO LRU for already-valid rangesHimal Prasad Ghimiray
A valid prefetch range skips migration and binding, so nothing refreshes its backing BOs on the LRU. Add xe_svm_range_prefetch_lru_bump(), which re-faults with no_dma_map and bumps each backing BO, and call it on the valid path. v2 - Make function failsafe (Matt/Sashiko AI comment) - Add stub for function Suggested-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20261001033602.3166274-10-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe: Bump prefetch BO LRU via GPUSVM devmem callbackHimal Prasad Ghimiray
Add xe_svm_devmem_lru_bump() and set it as drm_gpusvm_ctx.devmem_fn in the prefetch worker so each backing BO is moved to the LRU tail during get_pages. v2: - Guard xe_svm_devmem_lru_bump() against foreign device-memory allocations before casting to xe_bo: return early when devmem_allocation->ops != &dpagemap_devmem_ops. A shared device_private_page_owner can hand us another driver's allocation. (Matthew Brost / Sashiko AI review) - Add stub for function (CI) v3: - Guard xe_svm_devmem_lru_bump() body with CONFIG_DRM_XE_PAGEMAP; it references dpagemap_devmem_ops and to_xe_bo(), which only exist when PAGEMAP is enabled. Fixes the build with GPUSVM=y, PAGEMAP=n. (Sashiko AI review) v4: - Fix xe_svm_devmem_lru_bump() kernel-doc to explain the locking (Matt) Suggested-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20261001033602.3166274-9-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe/guc: Rewind the LRC ring head when replaying a ULLS jobVarun Gupta
On GT reset replay, guc_exec_queue_start() rewinds the software ring tail to the first unsignalled job's head and sets the LRC tail to the LRC head. This assumes the saved head has not passed an unstarted job, which holds for ordinary submission as the CS cannot run past a job it has not executed. A ULLS job's slot is covered by a tail its predecessor published from within the ring, so the CS can consume the slot and idle without the job having run, leaving the saved head past it. On replay the job is re-emitted behind the head, the context restarts with head == tail and the job never starts. Rewind the LRC head to the job's head as well when the first pending job is a ULLS job, so the re-emitted job is ahead of it. Non-ULLS replay is unchanged. Fixes: 40c756bdbbee ("drm/xe: Add ULLS migration job support to GuC submission") Cc: Matthew Brost <matthew.brost@intel.com> Assisted-by: LLM Signed-off-by: Varun Gupta <varun.gupta@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260930094031.3365707-8-varun.gupta@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe/guc: Publish the ring tail when replaying a chained ULLS jobVarun Gupta
A chained ULLS job skips the ring tail write in submit_exec_queue() since its predecessor's postamble has already published it from within the ring. After a GT reset the context is re-registered with scheduling disabled and that postamble is gone, so nothing publishes the replayed job's tail: the context is enabled with head == tail and the job never starts. On the kernel migration queue the second timeout wedges the device. Publish the tail for a chained job when the queue is not enabled. This is the state in which submit_exec_queue() already sends the scheduling enable H2G instead of relying on a resident context, and the tail write precedes that H2G. guc_exec_queue_stop() clears ENABLED on reset and register_exec_queue() does not set it, so the first replayed ULLS job always takes this path; its re-emitted postamble then publishes the next tail as usual. With the queue enabled nothing changes. job->restore_replay does not identify this case, it is only set on the SR-IOV VF pause/unpause path. Fixes: 40c756bdbbee ("drm/xe: Add ULLS migration job support to GuC submission") Cc: Matthew Brost <matthew.brost@intel.com> Assisted-by: LLM Signed-off-by: Varun Gupta <varun.gupta@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260930094031.3365707-7-varun.gupta@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe: Park on the ULLS semaphore before publishing the next job's tailVarun Gupta
The ULLS postamble publishes the next job's ring tail and only then parks on that job's semaphore. The CS fetches ring contents up to the tail while parked, so it can fetch the next job's slot while it still holds padding NOOPs. When the CPU later writes the job and signals the semaphore, the CS executes the stale fetch, drains to the tail and idles. The job never runs and its fence never signals. This is hit whenever the CS parks before the next chained job is written, e.g. when there is a pause between entering ULLS and the next migration job. A lost ULLS_EXIT is silent as the next job's seqno write covers its fence, but a lost ULLS_ACTIVE hangs the migration queue and the subsequent kernel job timeout wedges the device. Park first and publish the tail after the wait. The CS never fetches beyond RING_TAIL, so the next slot cannot be fetched until the job is in place. This puts the non-posted tail write on the wake-up path, which the original order was chosen to avoid, but that order is not safe. Fixes: 6ec0b87160be ("drm/xe: Add ULLS migration job support to ring ops") Cc: Matthew Brost <matthew.brost@intel.com> Assisted-by: LLM Signed-off-by: Varun Gupta <varun.gupta@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260930094031.3365707-6-varun.gupta@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe: Add focused VM teardown and page fault tracingDaniel Charles
Trace the start of VM teardown and ASID removal so late page faults can be correlated with the VM lifecycle. Emit one failure event for all page fault errors. Include the existing page fault reason alongside the errno. Keep the trace set focused by avoiding separate events for userptr pin attempts, individual close phases, ASID lookup rejection, and faults during shutdown. v2: Fix checkpatch warnings. v3: Pass xe to the page fault tracepoint and print VM mode as dma-fence/preempt-fence/fault (Matt) Assisted-by: GitHub Copilot using Claude Sonnet 5 Signed-off-by: Daniel Charles <daniel.charles@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260930164645.1243801-1-daniel.charles@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe/vm: Do not dma_fence_put zero fences in err_out pathJonathan Cavitt
It is not necessary to iterate over and dma_fence_put current_fence fences in the err_out path of ops_execute because current_fences cannot be non-zero when jumping to that section of code. Caught by static analysis. Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Cc: Shuicheng Lin <shuicheng.lin@intel.com> Cc: Maarten Lankhorst <dev@lankhorst.se> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260929205606.1076177-1-jonathan.cavitt@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe: Implement print vfunc for page fault info loggingBrian Nguyen
Add a print vfunc to xe_pagefault_ops so different producer backends can log specific relevant debug info while keeping the consumer layer free of potential backend-specific formatting logic. Consumer-specific error prints are handled by passing as input into the vfunc. v2: - Decode producer specific fields for print message. (Matthew) - Combine consumer and producer prints to one print call. (Sashiko) v3: - Change assert to WARN_ON_ONCE. (Matthew) Suggested-by: Stuart Summers <stuart.summers@intel.com> Signed-off-by: Brian Nguyen <brian3.nguyen@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260928222241.3815153-2-brian3.nguyen@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe/guc: Let xe_guc_ct_send_locked() callers reserve G2H creditSujaritha Sundaresan
Commit d4a7e1611716 ("drm/xe: batch CT pagefault acks with periodic flush") added a defer_flush argument to xe_guc_ct_send_locked(). At the same time it dropped the g2h_len and num_g2h arguments, which had no in-tree users, and hardcoded a zero G2H reservation. That leaves no way to send an H2G that expects a G2H reply while already holding ct->lock. The G2H receive path (parse_g2h_event() and g2h_fast_path()) releases credit unconditionally for replies such as DEREGISTER_CONTEXT_DONE, SCHED_CONTEXT_MODE_DONE and TLB_INVALIDATION_DONE. If the credit was never reserved, __g2h_release_space() reports an "Invalid G2H release" and marks the CT dead with CT_DEAD_G2H_RELEASE. Replacing two u32 arguments with a bool also means a caller written against the old signature can silently change meaning when the two reservation arguments get merged into one: the call still compiles, still sends the H2G, and loses only the reservation. Add g2h_len and num_g2h back, ahead of defer_flush, so that the function matches xe_guc_ct_send() and forwards both values to guc_ct_send_locked(). The kernel-doc now says when a reservation is required and that a non-zero reservation must not be made from a G2H handler, because waiting for credit can dequeue G2H inline. The only existing caller, the pagefault ack path, does not expect a reply. It passes 0, 0 and behaves exactly as before. Cc: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Sujaritha Sundaresan <sujaritha.sundaresan@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260929050342.221789-1-sujaritha.sundaresan@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe/xe3p: Force non-compressible memory reads to 256B overfetchesDaniel Charles
Add a tuning entry to set bit 14 (NONCOMPMEMRD256BOVRFETCHEN) of L3SQCREG2 for Xe3p and later platforms. BSpec: 72161, 59927 Signed-off-by: Daniel Charles <daniel.charles@intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260929200839.843116-1-daniel.charles@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe/nvl-s: Enable PXP for NVL-SAlan Previn
Now that the GSC FW is defined, we can enable PXP for NVL-S. The feature will only be turned on if the binary is found on disk. Signed-off-by: Alan Previn <alan.previn.teres.alexis@intel.com> Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com> Link: https://patch.msgid.link/20260923183600.1186943-6-alan.previn.teres.alexis@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe/gsc: Define GSC for NVL-SAlan Previn
NVL-S is identified by GSC major version 108. The compatibility version is 0.0. Signed-off-by: Alan Previn <alan.previn.teres.alexis@intel.com> Reviewed-by: Julia Filipchuk <julia.filipchuk@intel.com> Link: https://patch.msgid.link/20260923183600.1186943-5-alan.previn.teres.alexis@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe/cri: Expose device UID through sysfsBadal Nilawar
Expose a read-only sysfs attribute, device_uid, that reports the GPU SoC's unique identifier. Bspec: 53048, 53049 Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Badal Nilawar <badal.nilawar@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260929171823.3811737-2-badal.nilawar@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe/xe3p_lpg: Add support for Wa_16030224309Tangudu Tilak Tirumalesh
Opt in to the GuC workaround, to ignore context completion status with preemption or preemption-to-idle in the CSB when the multi-queue feature is enabled, which is supported on Graphics Version 35.10. This WA is supported starting from GuC 70.73. Apply Wa_16030224309 to Graphics Version 35.10. v2: Place this code near to KLV WAs. -Lin Shuicheng Signed-off-by: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com> Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Link: https://patch.msgid.link/20260925172722.238924-1-tilak.tirumalesh.tangudu@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-10-01drm/xe/display: use intel_gtt_view_is_*() helpers moreJani Nikula
Prefer using the intel_gtt_view_is_*() helpers instead of comparing the view type directly. Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/e05bf916d46007f8e655beb6c31748a8f69e09f3.1790780340.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-10-01drm/intel: rename i915_gtt_view* struct/enum to intel_gtt_view*Jani Nikula
Make enum i915_gtt_view_type and struct i915_gtt_view less i915 specific, and rename them enum intel_gtt_view_type and struct intel_gtt_view, respectively. $ sed -i 's/i915_gtt_view/intel_gtt_view/g' -- $(git grep -l i915_gtt_view) Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/4ca4ad3d11b0f8167a54d69d6eef0c8a78218c53.1790780340.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-10-01drm/intel: move i915_gtt_view_types.h to include/drm/intelJani Nikula
The i915 and xe drivers share i915_gtt_view_types.h from i915 source. Move it to include/drm/intel/gtt_view_types.h. Remove the i915 compat header. v2: Keep comment for header guard #endif (Ville) Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/174f7e26be755b29a1286bf8b8ef0342dcc083a6.1790780340.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-30drm: Move drm_timeout_abs_to_jiffies() to drm_timeout.cMaíra Canal
drm_timeout_abs_to_jiffies() began as a static helper inside the syncobj wait implementation and was later exported in place, so that it could be called by multiple drivers (e.g. panfrost, lima, tegra and accel drivers). All of them reach it through drm_utils.h. Give it a file of its own, so that timeout conversion helpers have a home, which will be useful when we add new timeout handlers. Also create a drm_timeout.h header to host all timeout-related helpers. The function was moved to the new file as it is, including the use of "signed long" as the return type. Note that the return and parameters types should be reconsidered in the future to better represent the non-negative nature of a timeout. No functional change. Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Christian König <christian.koenig@amd.com> Link: https://patch.msgid.link/20260915-drm-timeout-helpers-v3-1-f2ae987d861f@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-09-28drm/xe/pf: Keep VF LMEM BAR size low if no VFs enabledMarcin Bernatowicz
When VFs are enabled on dGFX the driver resizes the PF VF_LMEM_BAR to fit the requested layout. After VFs are disabled the PF VF BAR size is left as-is. On platforms with tight MMIO apertures a subsequent unplug/rescan followed by another enable may fail with: "VF BAR …: can't assign; no space" because the PCI core reserves address space based on the (now large) VF template, often multiplied by totalvfs. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5937 Fixes: 94eae6ee4c2d ("drm/xe/pf: Set VF LMEM BAR size") Signed-off-by: Marcin Bernatowicz <marcin.bernatowicz@linux.intel.com> Cc: Michał Wajdeczko <michal.wajdeczko@intel.com> Cc: Michał Winiarski <michal.winiarski@intel.com> Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/20260918110130.700332-1-marcin.bernatowicz@linux.intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> (cherry picked from commit 0646547a67d25c407f5a4ac71b4eefe8b941202b) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-09-28drm/xe/pf: Refactor VF LMEM BAR resize helper functionMichal Wajdeczko
Improve and move diagnostics messages to the helper function to keep the caller function tidy. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> Link: https://patch.msgid.link/20260911182306.14973-1-michal.wajdeczko@intel.com (cherry picked from commit 10628c52a3732a10426499a3d462cc2e6bc371ae) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-09-25drm/xe/i2c: Re-apply use device_create_managed_software_node()Bartosz Golaszewski
Original commit 0f485f88656a ("drm/xe/i2c: use device_create_managed_software_node()") got silently removed by commit cc467969646b ("Merge drm/drm-next into drm-xe-next"). Re-apply it. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260922-xe-i2c-reapply-swnode-unreg-v1-1-1bdda5d44701@oss.qualcomm.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> [Rodrigo: Modified commit message to reflect the right history]
2026-09-25drm/xe: Document ULLS for migration jobsMatthew Brost
Add a kernel-doc DOC section at the top of xe_migrate.c describing the Ultra Low Latency Submission (ULLS) scheme used for migration jobs. Cover the motivation (removing the H2G / GuC / context switch latency from the page fault and SVM prefetch critical paths), the platform requirements, the LRC PPHWSP semaphore layout and its relationship to the migration queue job count, the fixed ULLS job size and why it is needed, the ring preamble / postamble emitted by the ring ops including the in-ring tail update, the semaphore-only submission fast path in the GuC backend, and the enter / delayed exit flow along with the ULLS job flags. Hook the new section into Documentation/gpu/xe/xe_migrate.rst. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Assisted-by: Github-Copilot:Claude-opus-5 Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Link: https://patch.msgid.link/20260925201526.1355279-25-matthew.brost@intel.com
2026-09-25drm/xe: add migrate ULLS period configfs attributeMatthew Brost
Add a configfs attribute to control the migrate ULLS period.   The migrate ULLS period specifies how long, in milliseconds, migrate ULLS remains active before exiting. Migrate ULLS is currently used by page-fault handling and SVM prefetch operations to process migration work through a continuously running batch.   The attribute defaults to 5 ms. Setting the value to 0 disables ULLS.   This knob is primarily intended for performance tuning and evaluation, allowing experimentation with the trade-off between reducing ULLS startup/teardown overhead and limiting the time spent in a continuously running migration workload. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Link: https://patch.msgid.link/20260925201526.1355279-24-matthew.brost@intel.com
2026-09-25drm/xe: Enter ULLS for migration jobs upon page fault or SVM prefetchMatthew Brost
Call xe_migrate_ulls_enter upon page fault or SVM prefetch in an effort speed up these critical paths. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Link: https://patch.msgid.link/20260925201526.1355279-23-matthew.brost@intel.com
2026-09-25drm/xe: Add ULLS migration job support to GuC submissionMatthew Brost
Add ULLS migration job support to GuC submission backend. Changes required: - On migration queue, reduce max jobs to the number of ULLS semaphores minus one - Skip writing the saved ring tail for ULLS jobs except for the first ULLS job - the ring updates both the saved tail and the tail register itself - Set ULLS sempahore for current job releasing last job except for first ULLS job - Suppress submit H2G for ULLS except for first ULLS job Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Link: https://patch.msgid.link/20260925201526.1355279-22-matthew.brost@intel.com
2026-09-25drm/xe: Add ULLS migration job support to ring opsMatthew Brost
Add preamble and postamble for ULLS migrations jobs. Preamble clears current semaphore for reuse. Postamble waits on next semaphore which is set upon next job submission, then advances the ring tail over that job with an LRI to RING_TAIL, so submitting it costs the CPU nothing beyond signalling the semaphore. A job updates the tail on behalf of a successor which has not been emitted yet, so it cannot know how much ring that successor will occupy. Pad every ULLS job out to a fixed ULLS_JOB_SIZE_BYTES, which makes the next tail derivable from where the current job starts. The pad also supplies the NOPs which must follow an in-ring tail update. The last ULLS migration job skips BB submission, the postamble and the tail update (clear current semaphore, write seqno, exit ULLS), padding the difference so that it still fills a job slot. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Link: https://patch.msgid.link/20260925201526.1355279-21-matthew.brost@intel.com
2026-09-25drm/xe: Add ULLS migration job support to migration layerMatthew Brost
Add function to enter ULLS mode for migration job and delayed worker to exit (power saving). ULLS mode expected to entered upon page fault or SVM prefetch. ULLS mode exit delay is currently set to 5ms. ULLS mode only support on DGFX and USM platforms where a hardware engine is reserved for migrations jobs. When in ULLS mode, set several flags on migration jobs so submission backend / ring ops can properly submit in ULLS mode. Upon ULLS mode enter, send a job trigger waiting a semphore pipling initial GuC / HW conetxt switch. Upon ULLS mode exit, send a job to trigger that current ULLS semaphore so the ring can be taken off the hardware. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Link: https://patch.msgid.link/20260925201526.1355279-20-matthew.brost@intel.com
2026-09-25drm/xe: Add ULLS support to LRCMatthew Brost
Define memory layout for ULLS semaphores stored in LRC memory. Add support functions to return GGTT address and set semaphore based on a job's seqno. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Link: https://patch.msgid.link/20260925201526.1355279-19-matthew.brost@intel.com
2026-09-25drm/xe: Add device flag to enable PT mirroring across tilesMatthew Brost
Some multi-tile devices may want to mirror page tables across tiles for memory-bandwidth reasons, while others may not. Add a device flag that allows enabling or disabling page-table mirroring across tiles. Setting the flag to true (the existing behavior) on PVC, but both modes have been tested and are working on PVC. Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Maarten Lankhorst <dev@lankhorst.se> Reviewed-by: Francois Dugast <francois.dugast@intel.com> Link: https://patch.msgid.link/20260925201526.1355279-18-matthew.brost@intel.com