Merge tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "While this is large for rc8 time but also AI driven fixes is a lot of
  it, we had a more traditional screw up, and a regression was just
  found in the fair scheduling patches that went in back in rc1. This
  reverts the fair scheduler back to an option and sets the default back
  to what it should have been. We might have been a bit overly zealous
  in switching over, but at least it feels more normal than the AI
  driven fixes.

  Apart from the scheduler, it's mostly amdgpu and xe fixes, with some
  misc fixes to the log code and connector code.

  scheduler:
   - revert fair scheduler patches due to regression
   - mark fair as experimental

  connector:
   - fix OOB read in hdmi audio infoframe

  log:
   - fix divide by 0 if module param is set to 0
   - fix OOB read on empty message
   - fix infinite loop for too large scale

  xe:
   - Fix DPT Allocation paths
   - Fixes around UM queue BO
   - Order ring writes before ring tail updates
   - Add termination on resume for PXP
   - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe
   - Fix sync entry leak on OA config emit failure
   - Check managed mutex initilization errors
   - Fix min frequency setting
   - Fix xe_device_probe error path

  amdgpu:
   - Bounds checking fix in CS IOCTL
   - Bounds checking fix in GEM IOCTL
   - Display fixes
   - GPUVM fix
   - ASPM fix
   - UVD bounds checking fixes
   - VCE 3 fix
   - BT.2020 fixes
   - NBIF 6.3.1 fix
   - IP discovery fix

  radeon:
   - Runtime pm fix

  amdxdna:
   - skip attempting to populate unmapped pages"

* tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel: (51 commits)
  drm/log: Fix infinite loop when scale is too large for display
  drm/log: Fix out-of-bounds read on empty message length
  drm/log: Fix division by zero when scale module parameter is 0
  drm/xe: Fix xe_device_probe() failure
  drm/xe: Fix a bug in pc_adjust_freq_bounds()
  drm/xe/oa: Check managed mutex initialization errors
  drm/xe/oa: Fix sync entry leak on OA config emit failure
  drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe
  drm/xe/pxp: add termination on resume
  drm/xe: Order ring writes before ring tail updates
  drm/xe/guc_ads: use uncached mapping for UM queue BO
  drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
  drm/xe/guc_ads: allocate UM queues in a separate BO
  drm/xe: Fix DPT allocation paths.
  accel/amdxdna: Skip unmapped range in aie2_populate_range()
  drm/amdgpu: Prefer default discovery offset
  drm/amdgpu: Reject UVD message with invalid number of h265 refs
  drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
  drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
  drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
  ...

1 files changed, 38 insertions, 4 deletions

diff --git a/include/drm/gpu_scheduler.h b/include/drm/gpu_scheduler.h
index d61c19e78182..790f7ecb6b85 100644
--- a/include/drm/gpu_scheduler.h
+++ b/include/drm/gpu_scheduler.h
@@ -100,7 +100,8 @@ struct drm_sched_entity {
 	 * @lock:
 	 *
 	 * Lock protecting the run-queue (@rq) to which this entity belongs,
-	 * @priority and the list of schedulers (@sched_list, @num_sched_list).
+	 * @priority, the list of schedulers (@sched_list, @num_sched_list) and
+	 * the @rr_ts field.
 	 */
 	spinlock_t			lock;
 
@@ -154,6 +155,18 @@ struct drm_sched_entity {
 	enum drm_sched_priority         priority;
 
 	/**
+	 * @rq_priority: Run-queue priority
+	 */
+	enum drm_sched_priority         rq_priority;
+
+	/**
+	 * @rr_ts:
+	 *
+	 * Fake timestamp of the last popped job from the entity.
+	 */
+	ktime_t				rr_ts;
+
+	/**
 	 * @job_queue: the list of jobs of this entity.
 	 */
 	struct spsc_queue		job_queue;
@@ -249,7 +262,9 @@ struct drm_sched_entity {
 /**
  * struct drm_sched_rq - queue of entities to be scheduled.
  *
- * @lock: protects @entities, @rb_tree_root and @head_prio.
+ * @sched: the scheduler to which this rq belongs to.
+ * @lock: protects @entities, @rb_tree_root, @rr_ts and @head_prio.
+ * @rr_ts: monotonically incrementing fake timestamp for RR mode.
  * @entities: list of the entities to be scheduled.
  * @rb_tree_root: root of time based priority queue of entities for FIFO scheduling
  * @head_prio: priority of the top tree element.
@@ -259,8 +274,11 @@ struct drm_sched_entity {
  * the next entity to emit commands from.
  */
 struct drm_sched_rq {
+	struct drm_gpu_scheduler	*sched;
+
 	spinlock_t			lock;
 	/* Following members are protected by the @lock: */
+	ktime_t				rr_ts;
 	struct list_head		entities;
 	struct rb_root_cached		rb_tree_root;
 	enum drm_sched_priority		head_prio;
@@ -347,6 +365,13 @@ struct drm_sched_fence *to_drm_sched_fence(struct dma_fence *f);
  */
 struct drm_sched_job {
 	/**
+	 * @submit_ts:
+	 *
+	 * When the job was pushed into the entity queue.
+	 */
+	ktime_t                         submit_ts;
+
+	/**
 	 * @sched:
 	 *
 	 * The scheduler this job is or will be scheduled on. Gets set by
@@ -549,7 +574,11 @@ struct drm_sched_backend_ops {
  * @credit_count: the current credit count of this scheduler
  * @timeout: the time after which a job is removed from the scheduler.
  * @name: name of the ring for which this scheduler is being used.
- * @rq: Scheduler run queue.
+ * @num_user_rqs: Number of run-queues. This is at most
+ *                DRM_SCHED_PRIORITY_COUNT, as there's usually one run-queue per
+ *                priority, but could be less.
+ * @num_rqs: Equal to @num_user_rqs for FIFO and RR and 1 for the FAIR policy.
+ * @sched_rq: An allocated array of run-queues of size @num_rqs;
  * @job_scheduled: once drm_sched_entity_flush() is called the scheduler
  *                 waits on this wait queue until all the scheduled jobs are
  *                 finished.
@@ -581,7 +610,9 @@ struct drm_gpu_scheduler {
 	atomic_t			credit_count;
 	long				timeout;
 	const char			*name;
-	struct drm_sched_rq             rq;
+	u32                             num_rqs;
+	u32                             num_user_rqs;
+	struct drm_sched_rq             **sched_rq;
 	wait_queue_head_t		job_scheduled;
 	atomic64_t			job_id_count;
 	struct workqueue_struct		*submit_wq;
@@ -608,6 +639,8 @@ struct drm_gpu_scheduler {
  * @ops: backend operations provided by the driver
  * @submit_wq: workqueue to use for submission. If NULL, an ordered wq is
  *	       allocated and used.
+ * @num_rqs: Number of run-queues. This may be at most DRM_SCHED_PRIORITY_COUNT,
+ *	     as there's usually one run-queue per priority, but may be less.
  * @credit_limit: the number of credits this scheduler can hold from all jobs
  * @hang_limit: number of times to allow a job to hang before dropping it.
  *		This mechanism is DEPRECATED. Set it to 0.
@@ -621,6 +654,7 @@ struct drm_sched_init_args {
 	const struct drm_sched_backend_ops *ops;
 	struct workqueue_struct *submit_wq;
 	struct workqueue_struct *timeout_wq;
+	u32 num_rqs;
 	u32 credit_limit;
 	unsigned int hang_limit;
 	long timeout;