summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-10-01drm/amdgpu/gfx11: set KMD_QUEUE for kernel gfx queuesJesse Zhang
Set KMD_QUEUE in the GFX MQD and kernel ring control registers so CP preserves kernel IB VMIDs instead of replacing them with the queue VMID. Use prop->kernel_queue to distinguish kernel and user MQDs. Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 893642e0e3b2f5aa818e0ee4a49e2d401d541e3a)
2026-10-01drm/amdgpu/gfx12: set KMD_QUEUE for kernel gfx queuesJesse Zhang
Set KMD_QUEUE in the GFX MQD and kernel ring control registers so CP preserves kernel IB VMIDs instead of replacing them with the queue VMID. Use prop->kernel_queue to distinguish kernel and user MQDs. Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 14741c01680a803050e949744089b57fa53e02f7)
2026-10-01drm/amdgpu: fix empty fence backup and replay intervalsJesse Zhang
amdgpu_ring_set_fence_errors_and_reemit() and amdgpu_ring_backup_unprocessed_commands() masked last_seq and sync_seq to fence-array indices before the loop, then walked a do/while until the two indices met. When hardware completed every command before the driver signalled the fences, last_seq == sync_seq, but the masked-index do/while could not tell that empty interval from a full table and walked the whole fence array, backing up and replaying already-completed commands. Read the raw sequence numbers, return early through amdgpu_fence_process() when they are equal, and mask only at the array index. Guard the force-completion against a NULL guilty_fence so a non-guilty backup does not dereference it. Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 78fbe156637a11456fcd29615a56e098ec8a6990)
2026-10-01drm/amdgpu: support non-guilty job save on ring backupJesse Zhang
amdgpu_ring_backup_unprocessed_commands() is also used to preserve a ring that carries no guilty command - for example a collateral kernel gfx ring that shares the faulting pipe during a gfx user-queue pipe reset. Such a ring is backed up with a NULL guilty_fence and all of its unprocessed commands must be saved so they can be replayed after the reset rebuilds the ring's MQD. The early-return that skips an already-seen guilty fence compared "ring->guilty_fence == guilty_fence", which is also true when both are NULL. A non-guilty save therefore hit the early return and left ring_backup_entries_to_copy at 0, so the pending commands were dropped when the ring was rebuilt. Guard the early return with a non-NULL guilty_fence so a NULL fence never takes it and every unprocessed command is backed up. Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b3f73daa1c2498273981b68b7534e540614069e3)
2026-10-01drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DCTimur Kristóf
Unfortunately, some desktop boards eg. the FirePro D500 have the HARDWAREDC platform flag set and also have a battery power state configured in their VBIOS. This makes no sense for a desktop GPU and results in incorrect behaviour: the clocks are stuck at lowest. We observed that the kernel driver can work around the issue in two possible ways: 1. Set PPSMC_SWSTATE_FLAG_DC on all power states 2. Clear PPSMC_SYSTEMFLAG_GPIO_DC We think that the PPSMC_SYSTEMFLAG_GPIO_DC flag makes the SMC assume it's running on battery even though this is a desktop machine with no battery, and that's why it doesn't do DPM on power states without PPSMC_SYSTEMFLAG_GPIO_DC. Issue was uncovered by "Fix updating clock limits from power states" because previously the limits for the battery state were not tracked separately. However, battery power state has lower frequencies and voltages, so the kernel doesn't set the DC flag on the current power state anymore. That causes the SMC to be stuck on the lowest clocks. Let's clear PPSMC_SYSTEMFLAG_GPIO_DC on desktop GPUs. We can use the AMD_IS_MOBILITY flag to determine that. Fixes: e6c5d36756e7 ("drm/amd/pm/si: Fix updating clock limits from power states") Closes: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/16352 Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://patch.msgid.link/20260923120354.1027996-1-timur.kristof@gmail.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 58473c7c49ce9f5f5a4a1c24ffb9aa1d3c8771f4) Cc: stable@vger.kernel.org
2026-10-01drm/amd/display: Mark DCE 6.4 as not APUTimur Kristóf
DCE 6.4 is found in Oland chips, which were advertised as low-end gaming GPUs in 2013~2015 and then have been sold as low-end workstation GPUs until 2017~2019. These are not APUs. Fixes: 7c15fd86aaec ("drm/amd/display: dc/dce: add initial DCE6 support (v10)") Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://patch.msgid.link/20260923122033.1046651-3-timur.kristof@gmail.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1072aa811ea1e61d5f763e4ec1bc6d24bb61f14a) Cc: stable@vger.kernel.org
2026-10-01drm/amd/display: Fix fast updates on DCE 8.1Timur Kristóf
DCE8 should use legacy fast updates. This was already set for DCE 8.0 and 8.3, but it seems that DCE 8.1 (found in Kaveri chips) was forgotten. This fix should be backported to all kernel versions that have "Refactor fast update to use new HWSS build sequence", but this patch won't apply cleanly to older kernels due to another refactor in "Remove dc param from check_update". Fixes: 0baae6246307 ("drm/amd/display: Refactor fast update to use new HWSS build sequence") Fixes: 9ec11bb842b6 ("drm/amd/display: Remove dc param from check_update") Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://patch.msgid.link/20260923122033.1046651-2-timur.kristof@gmail.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 57605379559e3b5044c8274a1010ec658e5e73af) Cc: stable@vger.kernel.org
2026-10-01drm/amd/display: Fix fast updates on DCE 6.xTimur Kristóf
DCE6 should use legacy fast updates, just like all DCE8 - DCN2. Set that flag for DCE 6.0, 6.1 and 6.4 (all DCE6 versions). Technically DCE6 should have been included when the fast update code was refactored, but it just happened to work until now. A recent commit "Attach only plane updates that actually changed" has exposed this issue because with that commit, DC accidentally took the new fast update code path for DCE6 as well, which caused it to boot into a black screen with a flip done timeout. This fix should be backported to all kernel versions that have "Refactor fast update to use new HWSS build sequence", but this patch won't apply cleanly to older kernels due to another refactor in "Remove dc param from check_update". Fixes: 0baae6246307 ("drm/amd/display: Refactor fast update to use new HWSS build sequence") Fixes: 9ec11bb842b6 ("drm/amd/display: Remove dc param from check_update") Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://patch.msgid.link/20260923122033.1046651-1-timur.kristof@gmail.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 698fda6e360625850413a2d1a90b72ae5f03073d) Cc: stable@vger.kernel.org
2026-10-01drm/amd/display: Preserve eDP mode on initial ASSR failureArthur Heymans
Commit 56d8ce9d8c17 ("drm/amd/display: Apply correct panel mode when reinitializing hardware") made ASSR failure fall back to the default panel mode unless eDP mode had previously been applied. However, dc_link is zero-initialized and DP_PANEL_MODE_DEFAULT is zero. Before the first call to dp_set_panel_mode(), panel_mode therefore looks like a previously applied default mode. If ASSR setup fails during the first link training attempt, the driver incorrectly trains the eDP link using the default scrambling mode. On a Google Vilboz Chromebook running self-built coreboot firmware and PSP verstage, this leaves the panel mostly black with corrupted output along the top edge. Track whether panel_mode has actually been initialized, and only consult the saved mode after it has been applied. This retains the recovery behavior while preserving eDP mode during initial link training. Fixes: 56d8ce9d8c17 ("drm/amd/display: Apply correct panel mode when reinitializing hardware") Assisted-by: Pi:gpt-5.6-sol Reviewed-by: George Zhang <george.zhang@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Arthur Heymans <arthur@aheymans.xyz> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ccb6c2702033f1002b45807fb3cc938760f26f78) Cc: stable@vger.kernel.org # 6.4.x
2026-10-01drm/amd/display: Default HDMI RGB output to limited range on CTA modesAdrian Betschart
With the Broadcast RGB property at Automatic, amdgpu_dm_get_output_color_space() selects COLOR_SPACE_SRGB for RGB output, so DC neither compresses the pixels nor, without a QS-capable sink, signals full range in the AVI InfoFrame. A sink that follows CTA-861 treats the default quantization of a CTA video format as limited and expands 16-235 to 0-255: everything below 16 is crushed to black, everything above 235 clips. Follow the CTA-861 default for Automatic instead, as the DRM HDMI state helper (hdmi_is_limited_range()) and i915 do: limited range on an HDMI sink for CTA modes other than 640x480, full range elsewhere. Full and Limited keep their explicit meaning. The same rule applies to the BT.2020 RGB branch. With commit 892659399f64 ("drm/amd/display: Propagate HDMI RGB quantization selectability") the AVI InfoFrame then carries the matching Q value on sinks that support selection. Measured on a Radeon RX 7600 (DCN 3.2.1) driving a JVC DLA-RS4100 at 1920x1080p24 RGB 12 bpc: the sink reports the signal as limited range while the picture shows crushed shadows; rendering limited range in the client makes it match a reference source. The KUnit fixtures that reach amdgpu_dm_get_output_color_space() now carry a connector, since Automatic reads its display_info, and five cases cover the new rule. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5796 Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Adrian Betschart <adrian.betschart@cinemaone.ch> Assisted-by: Claude Code:claude-fable-5-1 Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d23f735d0eac52c673d91e21d146b09588537efc)
2026-10-01drm/amd/display: check dc_state_create_copy() for NULL in dm_suspendJiangshan Yi
dc_state_create_copy() can return NULL on allocation failure. dm_suspend() only conditionally skips dm_gpureset_toggle_interrupts() and continues execution, returning success. dm_resume() then dereferences the NULL cached_dc_state in link_enc_cfg_copy() and the following dc_state->stream_count loop, crashing during GPU reset recovery. Return -ENOMEM immediately if the copy fails, so the caller aborts suspend instead of leaving a NULL cached state for resume. Fixes: 8092aa3ab8f7 ("drm/amd/display: Add null checker before passing variables") Reviewed-by: George Zhang <george.zhang@amd.com> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 84b6d7932fdd2857795a257f9f258562a3cddcab) Cc: stable@vger.kernel.org
2026-10-02Merge tag 'drm-intel-gt-next-2026-10-01' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Driver Changes: - Fix incorrect RCU teardown order (Christian) - Fix potential UAF in command parsing code (Krzysztof) - Avoid WARN splat during RPS boosting race (Krzysztof) - Use simpler versions of min*() functions (Andy) - Selftest improvements (Sk, Krzysztof, Jansuz) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patch.msgid.link/ar5JFG3BmldEdDzF@jlahtine-mobl
2026-10-01drm/amdgpu: reset VI ASIC on MacBookPro14,3Francisco Beltrán Millalén
On a MacBookPro14,3 with a Radeon Pro 555 (Polaris11), the framebuffer is at MC address 0 when amdgpu loads after a cold boot, as the firmware leaves it (MC_VM_FB_LOCATION = 0x007f0000), while the VBIOS ASIC_Init table places it at 0xF4_0000_0000 (0xf47ff400). amdgpu reads the location once, at init, so after a re-POST (S3 resume or GPU reset) the framebuffer has moved and the driver keeps programming the old one: the SMU is handed a table that was never written and the GPU does not come back, which leaves the internal panel black. Resetting the ASIC on load makes ASIC_Init run before the driver reads the location, so the driver uses the VBIOS placement from the start and every later re-POST puts the framebuffer back where it already is. Add the Radeon Pro 555 used in this machine to the existing VI reset quirk table. Tested on a MacBookPro14,3 on 6.18.49 with the quirk table backported (the kernel also carries unrelated local PCI and ACPI patches for this machine). The framebuffer is at 0x000000F400000000 after both cold and warm boot, and the GPU survived 9 S3 cycles (lid close and rtcwake, one of them with the lid closed for about 7.5 minutes and a USB-C disk attached), each followed by a few minutes of 3D load; no ring timeouts or VM faults were reported. The reset adds about 0.23 s to amdgpu init. Suggested-by: Christian König <christian.koenig@amd.com> Suggested-by: Alex Deucher <alexander.deucher@amd.com> Link: https://lore.kernel.org/all/20260924132952.25054-1-fbeltranmillalen@gmail.com/ Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Francisco Beltrán Millalén <fbeltranmillalen@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: use pm_runtime_resume_and_get for ctx ioctlPierre-Eric Pelloux-Prayer
Only amdgpu_ctx_set_stable_pstate() communicates with the hw. v3 (Shahyan): fixed typo in commit description Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com> Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdkfd: Fix TCP XNACK scoreboard reset race on MI300Gang Ba
Fix a hardware RTL bug in the TCP XNACK scoreboard reset path on MI300, where a wave receiving a no-retry FAULT from UTC and subsequently terminating may leave its scoreboard entry uncleared when reset events arrive back-to-back. This can cause a later, unrelated wave using the same scoreboard slot to incorrectly inherit the XNACK error state, resulting in its VMEM operations being dropped even though the wave never faulted. Signed-off-by: Gang Ba <Gang.Ba@amd.com> Reviewed-by: Jay Cornwall <jay.cornwall@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu/userq: reject mappings without a backing BOJesse Zhang
PRT mappings have a bo_va but no backing BO. Reject them when validating queue buffers and when looking up the WPTR for MES or USERQ_SIGNAL, before passing the BO to the reservation or CPU mapping helpers. Repeat the check at the WPTR lookups because the VM reservation is dropped between initial validation and use. Without this, pointing a user queue's WPTR at a PRT (sparse) VA mapping makes mes_userq_create_wptr_mapping() dereference a NULL bo (base.bo) and oops in the reservation helper: BUG: kernel NULL pointer dereference, address: 0000000000000158 Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 4558 Comm: amd_fuzzing Tainted: G E 7.1.0+ RIP: 0010:drm_exec_lock_obj+0x2b/0x140 [drm_exec] CR2: 0000000000000158 Call Trace: drm_exec_prepare_obj+0x25/0x60 [drm_exec] mes_userq_create_wptr_mapping+0xc4/0x1c0 [amdgpu] mes_userq_mqd_create+0x351/0x870 [amdgpu] amdgpu_userq_ioctl+0x7ef/0xf80 [amdgpu] drm_ioctl_kernel+0xac/0x110 [drm] drm_ioctl+0x2c6/0x5b0 [drm] amdgpu_drm_ioctl+0x4f/0x90 [amdgpu] __x64_sys_ioctl+0xa0/0xf0 do_syscall_64+0xa3/0x4d0 Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: Flush the pasid on all XCCs in parallelDavid Yat Sin
amdgpu_vm_flush_compute_tlb() walks the XCCs of the compute partition one at a time, and amdgpu_gmc_flush_gpu_tlb_pasid() submits the invalidation to one XCC's KIQ and then busy-waits for its fence before the caller can move on to the next. On a partition that owns every XCC of the device that is num_xcc round trips back to back. The XCCs do not depend on each other here. Each has its own KIQ ring, ring lock and fence sequence, the page tables are already updated before any invalidation is issued, and no invalidation needs another XCC to have finished first. Split the submit out of amdgpu_gmc_flush_gpu_tlb_pasid() and add amdgpu_gmc_flush_gpu_tlb_pasid_xccs(), which queues the invalidation on every XCC in the mask before collecting any of the fences, so the round trips overlap. amdgpu_gmc_flush_gpu_tlb_pasid() becomes a one bit mask call into it, so both entry points share the reset-domain handling and the KIQ dispatch. Note that amdgpu_vm_flush_compute_tlb() no longer stops at the first XCC that fails. Every XCC in the mask is flushed regardless and the first error is returned, which is a deliberate behaviour change for callers: one XCC failing to queue its invalidation no longer leaves the remaining XCCs unflushed. Measured on gfx950 with all 8 XCCs in one SPX partition, revoking host memory access for a pasid mapped on every XCC. Traced with ftrace, amdgpu_vm_flush_compute_tlb() drops from 141 us to 65 us, against 23 us for the slowest individual XCC flush. The KFD SVM ioctl carrying that flush drops from 0.14 ms to 0.05 ms at p50. Assisted-by: Cursor:claude-opus-5 Signed-off-by: David Yat Sin <David.YatSin@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: rework eviction lock handling into critical section v3Christian König
Taking the eviction lock is actually just one step which we need to do in the critical section handling. Rename the functions to reflect that, use the update parameters instead of the vm to save the GFP flags. v2: rebased and reordered v3: fix rebase artefact, fix error handling in amdgpu_vm_pt_alloc Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Natalie Vock <nat@pixelcluster.dev> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: skip MGCG programming on a VF for gfx v12_1YuBiao Wang
MGCG registers are PF-only. Skip programming them under SR-IOV. Signed-off-by: Jane Jian <Jane.Jian@amd.com> Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: skip PF-only programming on the VFYuBiao Wang
Golden register init, the SDMA RB command switch setup, the GFXHUB L2 protection fault controls and the guest-side FB_LOCATION programming all touch registers a VF does not own, so leave them to the PF. Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: fix VFI XCC addressing for gmc v12_1 VM invalidationYuBiao Wang
The VM invalidation engine registers are always accessed with instance 0. Under SR-IOV the instance is forwarded to RLCG-VFI as the target XCC, so invalidating any GFXHUB other than the first one hits the registers of XCC 0. Pass the GFXHUB index as the register instance, and print the XCC ID in the VFI access messages. Signed-off-by: Jane Jian <Jane.Jian@amd.com> Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdkfd: mark queues as reset after a full GPU resetYuanShang
During a GPU reset, evict_process_queues_cpsch() calls remove_queue_mes() per queue, which fails with -EIO because the recovery path already holds the reset domain write lock. The loop aborts on the first queue, leaving the rest with is_active still set while the reset wipes the MES queue table. When the process later exits, process_termination_cpsch() sends REMOVE_QUEUE for doorbells MES no longer knows about. MES rejects them, the driver reports it as a timeout and concludes MES is unrecoverable, so it requests another GPU reset. Failed to evict queue 2 GPU reset(1) succeeded! failed to remove queue from MES, doorbell=0x1002 MES might be in unrecoverable state, issue a GPU reset GPU reset begin!. Source: 3 Mark every queue as reset in kgd2kfd_post_reset(). This clears is_active, corrects the queue counts and sets is_reset so the queue is skipped later. Add a verbose argument to set_queue_as_reset() so the full reset path does not log a message for every queue. Signed-off-by: YuanShang <YuanShang.Mao@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: add sriov microcode init for MP0 15.0.8YuBiao Wang
Set MES1 DATA as the last entry of the SR-IOV firmware list for MP0 15.0.8. Signed-off-by: YuBiao Wang <YuBiao.Wang@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu : Update psp 13_0_15 ip block support for unirasCe Sun
Included psp_13_0_15 ip block for uniras Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/amdgpu: Add newlines in drm_dbg format stringsEd Maste
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Ed Maste <emaste@FreeBSD.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: wire mes_dbgext on gfx11 and gfx12Yongqiang Sun
Add the per-IP hardware wiring that drives the mes_dbgext core on gfx11 (mes_v11_0 / gfx_v11_0) and gfx12 (mes_v12_0 / gfx_v12_0): handle MES_MISC_OP_SETUP_MES_DBGEXT in the misc-op path, unmask the MES debug interrupt, select the flat (gfx11) or zoned (gfx12) buffer format in sw_init(), start/stop the feature from hw_init()/hw_fini(), and drain the log from the EOP interrupt handler while the feature is active. Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com> Reviewed-by: Shaoyun Liu <Shaoyun.Liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: add mes_dbgext core supportYongqiang Sun
Add the core MES debug-extension logging layer in amdgpu_mes: allocate and initialize the firmware log buffer, and print messages to dmesg via interrupt or polling collection modes, with start/stop/notify and an amdgpu_mes_dbgext debugfs control. Expose the mes_dbgext_buffer_size and mes_dbgext_options module parameters to configure the buffer size and collection mode, and wire the debugfs init (amdgpu_debugfs_mes_init). Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com> Reviewed-by: Shaoyun Liu <Shaoyun.Liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/pm/si: Fix updating clock limits on AC/DCTimur Kristóf
Assume that the AC limits are the maximum of all power states, and the DC limits are the maximum of battery power states. This shouldn't make any difference in practice, but is cleaner and more robust against bogus information in the VBIOS. Fixes: e6c5d36756e7 ("drm/amd/pm/si: Fix updating clock limits from power states") Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Link: https://patch.msgid.link/20260923120354.1027996-2-timur.kristof@gmail.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: don't leak bo_va when gem_object_open failsXiang Liu
drm_gem_handle_create_tail() skips the close() callback when open() returns an error, so a bo_va added before a failing step is never removed. It stays linked on bo->vm_bo and a later eviction of that BO dereferences the VM after it has been torn down. Validate and fence the BO before adding the bo_va, drop the bo_va when attaching the eviction fence fails, and propagate the allocation failure from amdgpu_vm_bo_add(). Signed-off-by: Xiang Liu <xiang.liu@amd.com> Signed-off-by: Mukul Joshi <mukul.joshi@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: place VRAM-capable dma-buf imports in the PREEMPT domainMukul Joshi
An imported dma-buf BO backed by a VRAM-capable exporter holds no host pages of its own, yet when validated into TTM_PL_TT it is charged against the GTT page budget; importing many such buffers can exhaust that budget and fail with -ENOMEM even though no host memory is used. Set AMDGPU_GEM_CREATE_PREEMPTIBLE on these imports so they land in the PREEMPT domain instead, which is GTT-like and still bound (keeping the exporter resident) but carries no host-page limit. Signed-off-by: Mukul Joshi <mukul.joshi@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: Fix NPA BO memory accounting stats during import invalidationMukul Joshi
Use amdgpu_vm_bo_move() for updating the NPA BO memory accounting stats when the NPA BO is moved out from NPA domain into an empty placement. Without this, when the app finishes, it spits out a warning: "VM memory stats for proc .. task .. is non-zero when fini" This was only affecting the memory accounting stats, we were not leaking any memory here. Signed-off-by: Mukul Joshi <mukul.joshi@amd.com> Acked-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: re-check connection state before sending NPA-REVOKEMukul Joshi
The export cleanup worker checks amdgpu_ualink_check_conn_ready() once when building npa_release_bitmap, but not again in the send loop. Cleanup workers run concurrently on the unbounded NPA WQ (one per exported handle), so when a peer's egress dies many workers have already seeded npa_release_bitmap from a connection that was still ESTABLISHED and all issue an LSDMA copy to the dead peer, flooding the log with repeated NPA-REVOKE send failures. Re-check the connection immediately before each send, as the tlb shootdown, force_retry_rpcs and unmap_all_npa_addr loops already do, so once the first worker marks a peer NOT_READY the rest skip it. With the re-check in place, seed npa_release_bitmap with a single bitmap_copy() of importers_bitmap instead of a separate build loop; peers that fail the re-check or the send are dropped from the bitmap in the send loop. Signed-off-by: Mukul Joshi <mukul.joshi@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/display: Fix stale replay_events after mod_power stream removalSimon Polack
[Why] mod_power_remove_stream() shifts the remaining power_entity slots down but does not move replay_events, and mod_power_add_stream() does not initialize it. replay_events therefore stay bound to the map slot instead of the stream. When several streams are disabled in one atomic commit, amdgpu_dm_mod_power_update_streams() removes them one after another. The eDP stream can then be looked up in a slot whose stale replay_events already have replay_event_hw_programming set, so amdgpu_dm_replay_set_event() returns early ("already in desired state") without calling mod_power_set_replay_event(). Replay is not disabled before the eDP panel is powered off. After DPMS on, the sink reports neither replay state nor frame lock (DPCD 0x378 = 0x00, no error bits), so the HPD IRQ recovery does not trigger and the panel stays black until a full modeset. Seen with an eDP panel using FreeSync Replay plus two DP-MST displays: DPMS off/on of all outputs leaves eDP black, while DPMS of eDP alone works. Doing an eDP-only DPMS first makes the next all-output DPMS fail reliably. [How] Shift replay_events together with the PSR cached fields in mod_power_remove_stream() and initialize it to replay_event_vsync in mod_power_add_stream(), matching the psr_event_vsync initial value used for PSR (both vsync events are driven together by amdgpu_dm_crtc_set_static_screen_optimze()). Tested on 7.3.0-rc3 (238650ef6c7c): the reproducer above now recovers reliably, and Replay still engages when the screen is idle. The issue was debugged with help from an AI assistant (Claude), which analysed ftrace/kprobe traces and the driver source, pointed to the missing replay_events handling and suggested this change. I collected the traces and built and tested the fix on the affected hardware. Fixes: 4cef2ac4c795 ("drm/amd/display: Introduce power module on Linux") Assisted-by: Claude:claude-opus-5 Signed-off-by: Simon Polack <spolack+git@mailbox.org> Reviewed-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/display: fix unused function warningsArnd Bergmann
When CONFIG_DRM_AMD_DC_DCE is disabled, most functions insde dce110_hwseq.c are no longer referenced, causing a lot of warnings such as drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dce110/dce110_hwseq.c:3510:13: error: 'dce110_enable_analog_link_output' defined but not used [-Werror=unused-function] 3510 | static void dce110_enable_analog_link_output( | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dce110/dce110_hwseq.c:3391:13: error: 'dce110_set_cursor_attribute' defined but not used [-Werror=unused-function] 3391 | static void dce110_set_cursor_attribute(struct pipe_ctx *pipe_ctx) Replace the #ifdef with an IS_ENABLED() check that leads to an empty function in this configuration, so the compiler can eliminate the unused functions and not complain about it. Fixes: cd2cfe4d1504 ("drm/amd/display: gate DCE ASIC code behind CONFIG_DRM_AMD_DC_DCE") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/radeon: add a connector table for the Sun XVR-300Imre Kaloz
The Sun XVR-300 is a FireMV 2200 PCIe (RV370) board with an FCode-only Open Firmware ROM and no COMBIOS to parse, so the generic connector table leaves both DVI-I outputs undetected. Both XVR-300 SKUs report device ID 5b64 with an ATI subsystem ID rather than Sun's, so match the OF node name prefix instead. The table comes from the board's FCode. Signed-off-by: Imre Kaloz <kaloz@kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/radeon: Read the VRAM VBIOS signature with readb()Imre Kaloz
igp_read_bios_from_vram() checked bios[0]/bios[1] with a plain __iomem load, which faults on sparc64 before the copy runs at all. radeon_read_bios() already reads its two signature bytes with readb() ahead of its own copy; use the same accessor here, keeping the check before the allocation. Fixes: b442962a9e82 ("drm/radeon/kms: add support for "Surround View"") Signed-off-by: Imre Kaloz <kaloz@kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/display: guard dc_sink dereferences in MST mode validationHari Mishal
dm_dp_mst_is_port_support_mode() reads aconnector->dc_sink->dsc_caps... for the DSC branch-throughput check, and get_conv_frl_bw()'s HDMI-PCON FRL-bandwidth path reads aconnector->dc_sink->edid_caps.max_frl_rate, both without a NULL check. dc_sink is cleared asynchronously on MST unplug, and both functions run from paths that the driver's own comments document as racing that teardown: the connector probe worker's ->mode_valid callback and a compositor's atomic check, neither of which holds the MST manager lock that the teardown path uses. The former does have an existing dsc_aux NULL check, but dsc_aux isn't reliably cleared in every path that clears dc_sink, so it doesn't cover this. Fail the port-support check and skip the FRL conversion path when the sink is already gone. Fixes: f04d275d94e1 ("drm/amd/display: add mst port output bw check") Fixes: 5c9b8b27a883 ("drm/amd/display: Tie FRL support into amdgpu_dm") Assisted-by: gkh_clanker_t1000 Signed-off-by: Hari Mishal <harimishal1@gmail.com> Reviewed-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: Add package type mapping for EAMLijo Lazar
Package Type BB uses EAM design. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/display: Try RGB before YCbCr 4:4:4 in stream validationAdrian Betschart
amdgpu_dm_create_validate_stream_for_sink() walks encoding_order[] and uses the first encoding that validates. YCbCr 4:4:4 is listed before RGB, so an HDMI sink that advertises 4:4:4 gets YCbCr 4:4:4 whenever the "color format" property is left at AUTO, even though RGB fits the same link. That contradicts the documented AUTO behaviour for HDMI in enum drm_connector_color_format (RGB, falling back to YCbCr 4:2:0 only when the bandwidth is not available or the mode is 4:2:0-only), which the amdgpu implementation of the property also describes. It also leaves the "Broadcast RGB" property without effect on such sinks, since the quantization range it selects only applies to RGB output. Try RGB first. The mask still holds every encoding the sink supports, so a mode that cannot carry RGB falls back exactly as before. For reference, v7.2 picked RGB here unless YCbCr 4:4:4 was forced through debugfs, while earlier kernels picked YCbCr 4:4:4 for any HDMI sink that advertised it. Fixes: 0b0ff65d3ca1 ("drm/amd/display: Refactor stream validation") Suggested-by: Adolfo Rodrigues <adolfotregosa@gmail.com> Assisted-by: Claude Code:claude-fable-5-1 Signed-off-by: Adrian Betschart <adrian.betschart@cinemaone.ch> Reviewed-by: Fangzhi Zuo <jerry.zuo@amd.com> Tested-by: Adolfo Rodrigues <adolfotregosa@gmail.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: Fix race on ualink_handle_lo in UALink handle exportMukul Joshi
amdgpu_ualink_export_handle() tests robj->ualink_handle_lo and stores the generated handle into it without any lock; xa_lock only covers handle generation and the xarray insert. Two threads can therefore both observe a zero handle for the same BO and both allocate an exporter node, take an amdgpu_bo_ref() and insert into exp_xa, with the last store to ualink_handle_lo winning. Teardown only erases the handle recorded in the BO, so the losing node keeps its BO reference and pinned VRAM until device teardown. Each racing thread still generates its own handle and inserts its own node, but the handle is published to the BO under the BO reservation lock after re-checking that ualink_handle_lo is still zero. Exactly one thread makes that transition; the others find a non-zero value, roll back their node (erase from exp_xa, drop the DMABuf and BO references, free it) and return -EAGAIN so the caller retries and picks up the winning handle. This keeps a single exporter node per BO. Fixes: c67cb19811ec ("drm/amdgpu: Implement UALink handle export") Reported-by: Sashiko-bot <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260914054604.12850-1-kmehltretter@gmail.com?part=1 Signed-off-by: Mukul Joshi <mukul.joshi@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/pm: Fix metrics formatting in SMUv15.0.8Lijo Lazar
Use the right formatting for some fields which are encoded in Q10 format. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu/ras: allow ClearMcaOnRead during GPU recover resumeCe Sun
Allow RAS_MP1_MSG_ClearMcaOnRead MP1 message in Mode1 reset, to support device debug mode setup on GPU recovery resume. Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/ras: use __le32 pointer type to resolve the sparse warningsYiPeng Chai
Use __le32 pointer type to resolve the sparse warnings. sparse warnings: ras/core/eeprom.c:275:15: sparse: expected unsigned int [usertype] ras/core/eeprom.c:275:15: sparse: got restricted __le32 [usertype] ras/core/eeprom.c:277:15: sparse: expected unsigned int [usertype] ras/core/eeprom.c:277:15: sparse: got restricted __le32 [usertype] ras/core/eeprom.c:288:33: sparse: sparse: cast to restricted __le32 ras/core/eeprom.c:289:33: sparse: sparse: cast to restricted __le32 ras/core/eeprom.c:290:33: sparse: sparse: cast to restricted __le32 ras/core/eeprom.c:291:33: sparse: sparse: cast to restricted __le32 ras/core/eeprom.c:333:15: sparse: expected unsigned int [usertype] ras/core/eeprom.c:333:15: sparse: got restricted __le32 [usertype] ras/core/eeprom.c:343:15: sparse: sparse: cast to restricted __le32 Fixes: 5c3be5defc92 ("drm/amd/ras: Add eeprom ras functions") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202609101657.kczNjTnY-lkp@intel.com/ Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/ras: suppress warning for unsupported early init serviceYiPeng Chai
Suppress warning for unsupported early init service. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/ras: add error log for unhandled gpu mce dataYiPeng Chai
Add error log for unhandled gpu mce data. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amd/display: Fix sanitizer check for the DML frame size limitSasha Levin
Building x86_64 allmodconfig with clang fails: .../dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c:10491:13: error: stack frame size (3128) exceeds limit (3072) in 'dml_core_mode_programming' [-Werror,-Wframe-larger-than] That config enables both KASAN and UBSAN, and should get the 4096 byte limit meant for clang COMPILE_TEST sanitizer builds. The check in the dml and dml2_0 Makefiles concatenates the three symbols with no separator: ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)$(CONFIG_UBSAN)),y) KASAN and KCSAN cannot be enabled together, so before UBSAN was added the string was at most "y". UBSAN can be enabled alongside either of them, and with both set the string becomes "yy", $(filter y,yy) is empty, and the build falls through to the non-sanitizer limit of 3072. Adding UBSAN to the check therefore lowered the limit for the most heavily instrumented builds instead of raising it. Separate the symbols with spaces so that $(filter) sees individual words, and test for a non-empty result. Only the configs with two sanitizers enabled change behaviour. Found by KernelCI builds of the linus-next tree. Fixes: ebf8b0fd8508 ("drm/amd/display: Relax DML frame limit with UBSAN") Assisted-by: LLM Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu/gmc12.1: properly pass flush_type to gmc_v12_1_flush_vm_hub()Alex Deucher
In gmc_v12_1_flush_gpu_tlb(), flush_type was not properly passed to gmc_v12_1_flush_vm_hub(). This only affected the MMIO path. In most cases the flush would go through MES. Reviewed-by: Mukul Joshi <mukul.joshi@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: drop userq callback assignment for sdma 7.1Alex Deucher
Not enabled in 7.1 so drop the assignment. Cc: Horatio Zhang <hongkun.zhang@amd.com> Cc: Hawking.Zhang@amd.com Fixes: 4ed5116aacf6 ("drm/amdgpu: Add sdma v7_1_0 support") Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu/gfx6: fix firmware leak on teardownWillian Oliveira
The firmware requested in gfx_v6_0_init_microcode() is not released when the GFX block is torn down, leaking the firmware resources. Add gfx_v6_0_free_microcode() and call it from gfx_v6_0_sw_fini() to release the PFP, ME, CE and RLC firmware. Signed-off-by: Willian Oliveira <williandossantosdeoliveira287@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-10-01drm/amdgpu: fix ACP MFD device leak on init failureGuangshuo Li
acp_hw_init() registers ACP child devices with mfd_add_devices() before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain fails, or if the ACP reset or clock enable operation times out, the failure path frees only the source cell, resource, and platform-data allocations. The child platform devices already registered by mfd_add_devices() remain registered and are never released. Remove the children from the power domain and unregister the MFD devices on failures that occur after mfd_add_devices() succeeds. Keep mfd_add_devices() failures on the existing cleanup path since the MFD core already rolls back partially registered children itself. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fixes: 25030321ba28 ("drm/amd: add pm domain for ACP IP sub blocks") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>