summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/amd/amdgpu
AgeCommit message (Collapse)Author
21 hoursMerge tag 'drm-fixes-2026-11-07' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "This is the weekly drm fixes, amdgpu leading the way with some i915, nouveau and other fixes. There should be a bunch of xe fixes, but their tree got screwed up so I guess I'll send those next week once they cleanup whatever happened. atomic: - Fix CRTC dma-fence handling drm: - Add parsing for additional HDMI 2.2 FRL rates bridge: - nwl-dsi: Fix LCDIF handling dma-buf: - Fix IOVA offset - Restore the scatter-list entry count before freeing dp: - Keep MOT set between messages when no_zero_sized is set panel: - visionox-r66451: Set brightness MSB first; Increase reset waiting time panic: - Fix display loop - Fix line parsing sched: - Fix out of bounds entity priority check - Adjust run-queue when changing priority at runtime amdgpu: - UALink fixes - RAS fixes - GEM_OP fix - Parse IB fixes - CS user fence fix - GPU reset fixes - Multi-media idle work handler cleanup fixes - UserQ fixes - CRC fix - SR-IOV fixes - IP discovery fix - HDMI 2.2 FRL fixes - DDC pin fix - HUBP fix - SPM fix - DCN 3.2 fixes - VRR/freesync fix - Seamless boot fix - SMU 13.0.7 fix - Backlight fix - dma-buf fixes - GPUVM fixes - Move DMCUB back to VRAM - Non-DC audio fix - BACO fix amdkfd: - Fix WPTR BO eviction fence handling - GPUVM locking fix i915: - Fix GitLab #8991 where tiled displays (LG UltraFine 5K) broken on PTL - Limit NVL TRANS_VTOTAL.Vtotal skip display workaround to A-step - Single scaler per pipe number to 1 and disable pipe joiner on WCL - Add quirk to force backlight type on some TUXEDO devices - Fix "CMTG: A disable timeout" splat - Fix intel_vrr_dcb_vmin_vblank_start - Bunch of PSR fixes - Static checker fixes etnaviv: - Fix NULL dereference in etnaviv_unbind() - Flush the tile status cache through both the PE and BLT imagination: - Align rogue_fwif_hwrtdata to 64 bytes loongson: - Fix BO handling in several places nouveau: - Map Kepler video engine contexts non-privileged - Clear use.enabled when subdev init fails - Avoid running VBIOS twice - Fix CE channel creation on pre-Kepler GPUs v3d: - Initialize job timedout_batches - Fix cache_clean_lock vc4: - Move output fence and BO unreserve out of job_lock - Power down PYH when output is disabled - hdmi: Fix scrambling" * tag 'drm-fixes-2026-11-07' of https://gitlab.freedesktop.org/drm/kernel: (91 commits) drm/sched: Adjust run-queue when changing priority at runtime drm/sched: Fix out of bounds entity priority check drm/etnaviv: Flush the tile status cache through both the PE and BLT drm/etnaviv: Fix NULL dereference on unbind without PPU flop reset drm/nouveau: Fix CE channel creation on pre-Kepler GPUs drm/nouveau/devinit/gf100-: try to avoid double-running vbios scripts drm/dp: keep MOT set between messages when no_zero_sized is set drm/nouveau/nvkm: clear use.enabled when subdev init fails drm/nouveau/fifo: map Kepler video engine contexts non-privileged drm/amdgpu: don't drop the gang dependency fence twice drm/amdgpu: stop GPU recovery wait for the JPEG/VCN idle work drm/amd/pm: track BACO state in the SMU v11 ArmD3 sequence drm/amdgpu: Only enable HDMI audio if display supports it Revert "drm/amd/display: Allocate DCN32/1 dmub memory to GTT" drm/amdgpu: don't walk the CS chunks when allocating them failed drm/amdgpu/vce: don't allocate a scheduler fence in the direct IB test drm/amdgpu: rewrite all PTEs of the BOs after a VM reset drm/amdgpu: unlock the VM and BO when attaching a KFD BO fails drm/amdgpu: drop the dma-buf reference when a KFD import fails drm/amdgpu: Clamp the ATIF backlight curve to its 99 points ...
2 daysiommu/amd: Enable PerfOpt automatically for integrated GPUsMario Limonciello (AMD)
PerfOpt is usable by integrated GPUs in identity mode. Enable it from the IOMMU driver's domain attachment paths instead of requiring an amdgpu policy knob and exported enable/disable interfaces. Mark supported integrated GPUs as PerfOpt-eligible when selecting their default identity domain. Skip GCR3 setup and ATS/PRI/PASID enablement for these identity attachments, then enable PerfOpt after installing the DTE. Clear PerfOpt before attaching an eligible GPU to a translated or blocked domain, including unmanaged domains used by VFIO. Propagate failures to clear bypass, but keep a completed identity attachment successful if the optional PerfOpt enable fails. Clear inherited PerfOpt state during initialization, including when a crash kernel reuses device tables. Read feature support directly from hardware because cached features may not be available yet, and stop initialization if the initial clear fails. Each IOMMU has at most one PerfOpt-eligible GPU, so track activation with a boolean under the IOMMU lock. Preserve this state while clearing hardware at suspend and shutdown, and restore the bit on resume only where it was active. Do not enable PerfOpt unconditionally during early IOMMU initialization. Remove the amdgpu parameter, driver callbacks, and exported interfaces. Translated attachments retain their normal device capability setup. Suggested-by: Jason Gunthorpe <jgg@ziepe.ca> Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Vasant Hegde <vasant.hegde@amd.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
4 daysdrm/amdgpu: don't drop the gang dependency fence twiceJesse Zhang
drm_sched_job_add_dependency() drops the fence reference when it fails, but amdgpu_cs_submit() drops it again, so the scheduled fence of a gang member loses a reference it still needs. A GFX+COMPUTE gang waiting for another context, with the xarray node allocation for the leader's dependency failed through failslab: WARNING: drivers/dma-buf/dma-fence.c:589 at dma_fence_release+0x34d/0x730, CPU#1: amd_uapi_regres/2993 drm_sched_job_cleanup+0x2c2/0x340 [gpu_sched] amdgpu_job_free+0xcb/0x3e0 [amdgpu] amdgpu_cs_parser_fini+0x435/0x710 [amdgpu] amdgpu_cs_ioctl+0xcd2/0x7a60 [amdgpu] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:dma_fence_signal_timestamp_locked+0x1b8/0x610 Fixes: ed21f6c3fe42 ("drm/amdgpu: fix another missing fence reference in the CS code") Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 5aa070a83c8378810b906cc8bfc650ce69822a7c) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: stop GPU recovery wait for the JPEG/VCN idle workPrike Liang
The common JPEG and VCN idle workers program power gating and DPG pause, so they must not run while a GPU reset is in progress. Recovery must not wait for them either, since everything the workers depend on then becomes a dependency of GPU recovery. Make the workers take reset_domain->sem for read, so they wait for a running reset instead of touching the hardware. hw_fini/suspend, the hw_init error paths and begin_use, the latter for the IB tests, run from GPU recovery as well, so only skip waiting for the idle work when the reset itself calls them. The reset holds the semaphore for write and would otherwise deadlock on a worker blocked on it. Outside a reset the cancel stays synchronous as before. A device can also be torn down while a peer in its XGMI reset domain is being reset. hw_fini then doesn't wait for the worker either, and is skipped entirely if the peer's reset has already suspended the device. Cancel the idle work synchronously in early_fini, which only runs on teardown and before any hw_fini, so the worker is done before the hardware it touches is torn down. Teardown has drained the rings before early_fini, so nothing queues the work again and hw_fini only cancels it outside teardown, for suspend and GPU reset. The JPEG suspend and sw_fini callbacks no longer cancel it a second time; replace amdgpu_jpeg_suspend(), which only did that, with amdgpu_jpeg_cancel_idle_work() as on the VCN side. Update versions: v1: https://lists.freedesktop.org/archives/amd-gfx/2026-October/155441.html v2: https://lists.freedesktop.org/archives/amd-gfx/2026-October/156119.html v3: https://lists.freedesktop.org/archives/amd-gfx/2026-November/156456.html Signed-off-by: Prike Liang <Prike.Liang@amd.com> Cc: Leo Liu <leo.liu@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Leo Liu <leo.liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 945ef007af8cb720ee58bc5a19def034a7c8dd15)
4 daysdrm/amdgpu: Only enable HDMI audio if display supports itrenpanpan
The amdgpu legacy DCE audio path (dce_v6/v8/v10) unconditionally calls audio_enable(pin, true) at the end of afmt_setmode(), regardless of whether the connected display advertises audio support in its EDID. This causes a phantom HDMI audio output to appear for displays that have no audio capability (no basic audio bit, no Audio Data Block in EDID), because the GPU sets the AUDIO_ENABLED register bit, which drives the HDA codec's ELDV pin sense, making the codec report the jack as audio-available. The radeon, nouveau, and dw-hdmi drivers all gate audio enablement on display_info.has_audio. Apply the same check to amdgpu's DCE afmt_setmode functions. Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: renpanpan <renpanpan@kylinos.cn> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 842a45c68e0355eea47796551c8761c0c77e8ce0) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: don't walk the CS chunks when allocating them failedJesse Zhang
amdgpu_cs_pass1() sets p->nchunks before allocating p->chunks, and the allocation failure path skips resetting it. amdgpu_cs_parser_fini() then frees the kdata of nchunks chunks from a NULL array. On navi48 with the chunk array allocation failed through failslab: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:amdgpu_cs_parser_fini+0x35d/0x710 [amdgpu] amdgpu_cs_ioctl+0xcae/0x7a20 [amdgpu] drm_ioctl_kernel+0x180/0x320 [drm] Set nchunks once the array exists. Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 0c828445757b86aaa3ed2638832d76f450022bdf) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu/vce: don't allocate a scheduler fence in the direct IB testPrike Liang
The IB tests run inside GPU recovery, which must not allocate memory with reclaim. The direct IB pool and the job allocation use GFP_ATOMIC for this reason. amdgpu_vce_get_create_msg() and amdgpu_vce_get_destroy_msg() still pass the VCE scheduler entity for direct submissions, so drm_sched_job_init() allocates a scheduler fence with GFP_KERNEL that the direct submission never uses. The create message is always submitted directly, so don't pass the entity there. The destroy message also goes through the scheduler when the handles of a closed file are freed, so only pass the entity for those scheduled submissions. Signed-off-by: Prike Liang <Prike.Liang@amd.com> Cc: Leo Liu <leo.liu@amd.com> Reviewed-by: Leo Liu <leo.liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 995905389d93b19e9b77cf11cae16454458bf8dd)
4 daysdrm/amdgpu: rewrite all PTEs of the BOs after a VM resetJesse Zhang
amdgpu_vm_bo_reset_state_machine() moves all idle vm_bos to needs_update so that their mappings are written again, e.g. after a GPU reset lost VRAM. Since commit 5be7f6720a0f ("drm/amdgpu: Only set bo->moved when the BO was actually moved") amdgpu_vm_bo_needs_update() no longer sets the moved flag, so amdgpu_vm_bo_update() writes nothing for the kernel and always valid BOs. The same applies to vm_bos already on a needs_update list, e.g. after an AMDGPU_VM_DELAY_UPDATE mapping, where only the new mapping gets written. An SDMA write to an always valid BO after a VRAM-losing reset faults: amdgpu 0000:03:00.0: VRAM is lost due to GPU reset! amdgpu 0000:03:00.0: [gfxhub] page fault (src_id:0 ring:40 vmid:7 pasid:9) amdgpu 0000:03:00.0: in page starting at address 0x0000000100000000 from client 10 Set the moved flag for all vm_bos on the needs_update lists after moving the idle ones there; the root PD still goes back to idle. Fixes: 5be7f6720a0f ("drm/amdgpu: Only set bo->moved when the BO was actually moved") Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d397f95f63cc0f711c3e8f2043edc59b575345ab) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: unlock the VM and BO when attaching a KFD BO failsJesse Zhang
kfd_mem_attach() locks the page directory and the BO with a drm_exec transaction on its stack, but leaves through the unwind label without drm_exec_fini() when locking fails, e.g. when MAP_MEMORY_TO_GPU gets a signal while the page directory or the BO is busy. Reservations already acquired then remain locked with their ww_acquire_ctx pointing into the expired stack frame. With one thread doing GEM_VA map/unmap on the KFD VM and another one mapping KFD BOs while getting SIGUSR1 every 20 us: BUG: KASAN: stack-out-of-bounds in __ww_mutex_lock.constprop.0+0x34f5/0x3da0 ww_mutex_lock_interruptible+0x2f/0x150 drm_exec_lock_obj+0x107/0x2d0 [drm_exec] kfd_mem_attach+0x4dd/0x1b60 [amdgpu] and the process ends up in D state. Finish the transaction before unwinding. Fixes: fd1fa48b935f ("drm/amdgpu: lock both VM and BO in amdgpu_gem_object_open") Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 7b885fa27e4b9fa5cbdc64e66fc35872aee296f5) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: drop the dma-buf reference when a KFD import failsJesse Zhang
import_obj_create() takes a reference on the dma-buf for the new kgd_mem, but the error path after validating the BO doesn't drop it. Since the validation reserves the BO interruptibly, an import failing with -ERESTARTSYS leaks the exported BO with its memory, and keeps the module in use. Importing a 64 MiB VRAM BO in a loop while getting SIGUSR1 every 20 us and another thread changes the BO's mappings: INFO: 171821 imports, VRAM used before 65 MiB, after 129 MiB modprobe: FATAL: Module amdgpu is in use. Drop the reference, and free the sync object and the mutex of the kgd_mem as well. With that VRAM usage returns to 65 MiB after the same test. Fixes: 0e2e7c5b3d71 ("drm/amdgpu: Attach eviction fence on alloc") Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b4d1eca2729840148ff2ea957724ce764ca5a94e) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: Clamp the ATIF backlight curve to its 99 pointsHugo Sales
amdgpu_atif_query_backlight_caps() stores the firmware's number_of_points as data_points but copies only the 99 points that luminance_data[] holds. number_of_points is a u8, so a firmware table that claims more makes the custom curve code in amdgpu_dm index past the array, and dm_query_extended_brightness_caps() copy past the end of the data_points[] buffer it fills Clamp the count to ATIF_QBTC_MAX_DATA_POINTS and warn, since a table that claims more is a firmware bug Fixes: f729e63743f0 ("drm/amd: Pass luminance data to amdgpu_dm_backlight_caps") Signed-off-by: Hugo Sales <hugo@hsal.es> Link: https://patch.msgid.link/20261031153948.127016-1-hugo@hsal.es Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit af8a1c2b7d3de4960e10f94e8ba2fc0ccd168072) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: Report MES ring wait timeouts.Erhan Bilgili
Return -ETIMEDOUT when the fence wait before submission expires instead of reporting success without submitting the packet. Fixes: 34e087e8920e ("drm/amdgpu/mes: fix mes ring buffer overflow") Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Erhan Bilgili <erhan.bilgili@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 34341594a87b4a3f28be41e3e70a4787f02b3d9e) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: Fix duplicate dependency fence releasesErhan Bilgili
drm_sched_job_add_dependency() consumes its fence reference on success and failure. Do not release the fence again if drm_sched_job_add_dependency() fails. Fixes: 41cc108b2451 ("drm/amdgpu: fix missing dma_fence_put in error path") Fixes: c1c4a8b21721 ("drm/amdgpu: grab extra fence reference for drm_sched_job_add_dependency") Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Erhan Bilgili <erhan.bilgili@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit e04f3dfb2071451633e6440a3911a9bb65df9144) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu/gfx12: disallow GFXOFF while updating the SPM VMIDJesse Zhang
gfx_v12_0_update_spm_vmid() does a read-modify-write of RLC_SPM_MC_CNTL over MMIO without keeping GFX powered, unlike gfx11. When GFX is in GFXOFF at that point the update doesn't stick, and with the SPM VMID programmed on submission again, the job of a process with a reserved VMID can still run with the SPM writing through VMID 0. On navi48, after a few other submissions and a VM fault on the same VM, a COPY_DATA of RLC_SPM_MC_CNTL from such a job reads 0 although the update was called for it: $ amd_uapi_regression --run-subtest cs-secure-ib-compute,gem-mapping-info-high-va,gpuvm-fault-high-va,reserved-vmid-spm-vmid amdgpu 0000:03:00.0: [gfxhub] page fault (src_id:0 ring:40 vmid:7 pasid:185) amdgpu 0000:03:00.0: Faulty UTCL2 client ID: SDMA1 (0xe) RLC_SPM_MC_CNTL in the job: 0x00000000 With GFXOFF disallowed around the update it reads the reserved VMID 15. Fixes: 52cb80c12e8a ("drm/amdgpu: Add gfx v12_0 ip block support (v6)") Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 907aebc5578ae09fa5c0e2f0784201295837e60b) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: publish IH enabled before PSP programs IH_RB_CNTLMilan Milicevic
On SR-IOV, programming IH_RB_CNTL through PSP is slow enough for the first MSI to arrive before ih->enabled is set. amdgpu_ih_process() then drops the interrupt, rptr stays at 0, and RPTR_REARM never generates another edge, so every ring hits the fence fallback timer. Set ih->enabled before psp_reg_program() on the indirect IH path for Navi10 and IH v6.0, and clear it if programming fails. Signed-off-by: Danijel Slivka <Danijel.Slivka@amd.com> Signed-off-by: Milan Milicevic <Milan.Milicevic@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b2f9434f9d17c94798e8d8957af3adc4a9949016) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: Ensure that harvest information gets setKent Russell
After the earlier patch exported IP discovery on probe failure, there was an unexpected consequence where harvest info was not populated. The early-exit in amdgpu_discovery_sysfs_init meant that we never called amdgpu_discovery_get_harvest_info, which is where we set the actual harvest value. The first time we call amdgpu_discovery_sysfs_recurse with NULL instead of adev, most values can get set. The 2nd time amdgpu_discovery_sysfs_recurse is called, we bail early. To keep the logic of the first patch intact, ensuring that older kernels can still discover the IP blocks, add a separate call in the early-exit section that sets the harvest information. This should be the only functionality that is missed in this flow, as the rest of the calls either work fine with adev=NULL, or use the discovery_bin directly. Fixes: 402e04f11ff7 ("drm/amdgpu: Export ip_discovery sysfs on probe failure") Assisted-by: LLM Claude Signed-off-by: Kent Russell <kent.russell@amd.com> Reviewed-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ca0812a625d112df556e37550e6accceea33e485) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: stop the schedulers before preparing the GPU resetPrike Liang
amdgpu_device_halt_activities() only stops the ring schedulers after amdgpu_amdkfd_pre_reset() and amdgpu_userq_pre_reset(). With a hung MES every REMOVE_QUEUE in amdgpu_userq_pre_reset() waits for its timeout, so the schedulers keep pushing jobs to the hardware for seconds after the reset has started: GPU reset begin!. Source: 6 MES failed to respond to msg=REMOVE_QUEUE fence_wait_ret=528494 status=0x0 WARNING: amdgpu_device.c:928 at amdgpu_device_skip_hw_access+0x73/0x90 [amdgpu] Workqueue: sdma0 drm_sched_run_job_work [gpu_sched] Call Trace: amdgpu_mm_wdoorbell64+0x20/0x70 [amdgpu] sdma_v6_0_ring_set_wptr+0xa6/0x180 [amdgpu] amdgpu_ring_commit+0x5b/0xa0 [amdgpu] amdgpu_ib_schedule+0x64a/0x8f0 [amdgpu] amdgpu_job_run+0xa2/0x220 [amdgpu] drm_sched_run_job_work+0x10c/0x300 [gpu_sched] Stop the schedulers of all devices in the reset list first. None of the preparation steps needs them, and jobs submitted meanwhile simply wait until amdgpu_device_sched_resume(). Fixes: 290f46cf5726 ("drm/amdgpu: Implement user queue reset functionality") Signed-off-by: Prike Liang <Prike.Liang@amd.com> Acked-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ea55250ab5594032541c455e1b84e8a7c15a2ba4) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for navi10_ihMilan Milicevic
Port this change to navi10_ih.c: commit afbf7955ff01 ("drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts") Setting IH_RB_WPTR to 0 does not clear RB_OVERFLOW if RB_ENABLE is not set. Pulse WPTR_OVERFLOW_CLEAR after RB_ENABLE (and with WPTR_OVERFLOW_ENABLE) so overflow is cleared when interrupts are enabled. Signed-off-by: Danijel Slivka <Danijel.Slivka@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Milan Milicevic <Milan.Milicevic@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 713fb4ab04f4d2af6120f8eb607c5673b2759b38) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: finish GPU recovery callbacks before restarting schedulersPrike Liang
Run GPU post-reset callbacks, including KFD and display-audio resume, before restarting DRM scheduler workqueues. IP hardware initialization already happens inside ASIC recovery; this change orders the remaining callbacks before new scheduler submissions. Preserve the emergency-stop and guity job completition path's callbacks without starting schedulers, Signed-off-by: Prike Liang <Prike.Liang@amd.com> Acked-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1f6433e2b264e75c56ae95f187788806201bdbc3) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu/userq: validate the moved individual BOs on restoreJesse Zhang
An individual BO of a user queue VM, i.e. one which doesn't share the root reservation, goes to the individual needs_update list when it is evicted. The user queue restore looked at vm->invalidated for them, which the VM state machine rework turned into the always_valid evicted list and commit 18decfc9e8cc ("drm/amdgpu/userq: actually validate userq BOs") into the individual evicted one. That list only holds imported DMA-bufs of compute VMs though, so for a user queue VM nothing is validated. The restore then neither locks such a BO nor moves it back. Its PTEs are updated to wherever it is now, cleared if it went to system memory, and it doesn't get the new eviction fence, so it can move again under the running queue. On navi48, once the BOs of an SDMA user queue are evicted from GTT (debugfs amdgpu_evict_gtt) the queue faults on its ring and rptr: amdgpu 0000:03:00.0: in page starting at address 0x0000000100000000 from client 10 amdgpu 0000:03:00.0: Faulty UTCL2 client ID: SDMA0 (0xd) amdgpu 0000:03:00.0: in page starting at address 0x0000000100101000 from client 10 Validate the BOs on the individual needs_update list like before. Fixes: 4cdbba5a16aa ("drm/amdgpu: restructure VM state machine v4") Fixes: 18decfc9e8cc ("drm/amdgpu/userq: actually validate userq BOs") Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit eb0d94765d4be18d41e93ad09947dd9cc06ed31a) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: check amdgpu_vm_ready() in dma-buf move notifyDariusz Marcinkiewicz
amdgpu_dma_buf_move_notify() touches the page tables without first calling amdgpu_vm_ready(). When a process is SIGKILLed, its VM entities are stopped. Teardown of an imported dma-buf then tries to clear PTEs by submitting to one of those stopped entities. That eventually hangs the task. Commit aa5fc4362fac ("drm/amdgpu: fix task hang from failed job submission during process kill") added the stopped entity check in amdgpu_vm_ready() and used it in amdgpu_cs_vm_handling(). That did not cover a call in amdgpu_dma_buf_move_notify(), what was already mentioned in: https://lists.freedesktop.org/archives/amd-gfx/2025-October/133076.html Tested by SIGKILLing a GPU workload holding imported dma-bufs. Without the patch "Trying to push to a killed entity" errors are logged, then a task hangs. With the patch there are no hung tasks. This was tested on a 6.18 kernel. Fixes: aa5fc4362fac ("drm/amdgpu: fix task hang from failed job submission during process kill") Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dariusz Marcinkiewicz <darekm@google.com> Assisted-by: LLM Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit bee5c9d7a34cb1b510ad3b4c18c30f9d38b0ab7d) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: cancel idle work in hw_init failure paths for vcn/uvd/vce/jpegLeo Liu
When hw_init() fails, amdgpu_device_ip_fini_early() skips hw_fini() because status.hw was never set. For VCN, UVD (including UVD ENC), VCE, and JPEG, hw_fini() is where cancel_delayed_work_sync() is called. Any idle work queued during the partial hw_init() is therefore left pending after sw_fini() frees the adev state the handler touches. Cancel the idle work in each hw_init() error path, immediately before returning the error, so that hw_fini() remains the sole cancel site on the normal teardown path with no duplication. Link: https://github.com/ROCm/amdgpu/issues/234 Fixes: 416e1fab4752 ("drm/amdgpu: drop redundant cancel_delayed_work_sync call") Assisted-by: Claude:Claude-Sonnet-4.6 Signed-off-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 7ff2327fde029e97d0050fcb94e3f4063c318547) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu/userq: wait for GPU reset before mapping or unmapping queuesPrike Liang
The user queue map and unmap helpers talk to the MES, but only the create path holds reset_domain->sem around them. The eviction, restore, destroy and suspend paths can submit to the MES while a GPU reset is in progress: WARNING: amdgpu_device.c:928 at amdgpu_device_skip_hw_access+0x73/0x90 [amdgpu] Workqueue: events amdgpu_eviction_fence_suspend_worker [amdgpu] Call Trace: amdgpu_mm_wdoorbell64+0x20/0x70 [amdgpu] mes_v11_0_ring_set_wptr+0x71/0x80 [amdgpu] amdgpu_ring_commit+0x5b/0xa0 [amdgpu] mes_v11_0_submit_pkt_and_poll_completion.constprop.0+0x207/0x520 [amdgpu] mes_v11_0_remove_hw_queue+0xd9/0x100 [amdgpu] mes_userq_unmap+0xc3/0x140 [amdgpu] amdgpu_userq_unmap_helper+0x67/0x280 [amdgpu] amdgpu_userq_evict+0x52/0xf0 [amdgpu] amdgpu_eviction_fence_suspend_worker+0x55/0xe0 [amdgpu] Take the semaphore for read in the helpers instead, around both the MES call and the queue state check and update. The reset changes the queue state from amdgpu_userq_pre_reset()/post_reset(), so every caller now waits for a running reset and acts on the state it left behind. Signed-off-by: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit e6a8b8588f43bd4d7054ac47cccc35f56ad2df90) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu/uvd: don't allocate or lock BOs in the direct IB testPrike Liang
The IB tests run inside GPU recovery, which must not allocate memory with reclaim, take BO reservation locks or depend on eviction. The direct IB pool and the job allocation use GFP_ATOMIC for this reason. amdgpu_uvd_send_msg() still passes the UVD scheduler entity for direct submissions, so drm_sched_job_init() allocates a scheduler fence with GFP_KERNEL that the direct submission never uses. It also reserves the message BO and adds the fence to it, which takes the reservation lock, can allocate a fence slot with GFP_KERNEL and falls back to a blocking dma_fence_wait(). Only pass the entity for scheduled submissions. The direct message BO is only used by the IB test, which waits for each fence itself, so only fence the BO for scheduled submissions. Signed-off-by: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1473ee6ae24d5b61c3165c444167a9d2069e1ab9)
4 daysdrm/amdgpu/mes: skip unmap queue notification during GPU resetPrike Liang
amdgpu_mes_userq_notify_unmap_work_handler() submits a MES misc op without holding reset_domain->sem, so it can ring the MES doorbell while the GPU is being reset: WARNING: amdgpu_device.c:928 at amdgpu_device_skip_hw_access+0x73/0x90 [amdgpu] Workqueue: events amdgpu_mes_userq_notify_unmap_work_handler [amdgpu] Call Trace: amdgpu_mm_wdoorbell64+0x20/0x70 [amdgpu] mes_v11_0_ring_set_wptr+0x71/0x80 [amdgpu] amdgpu_ring_commit+0x5b/0xa0 [amdgpu] mes_v11_0_submit_pkt_and_poll_completion.constprop.0+0x207/0x520 [amdgpu] mes_v11_0_misc_op+0x8b/0x240 [amdgpu] amdgpu_mes_notify_unmap_queue+0xa3/0x110 [amdgpu] amdgpu_mes_userq_notify_unmap_work_handler+0x24/0x70 [amdgpu] Only send the notification when reset_domain->sem can be trylocked. The work re-arms itself while the HW queues are oversubscribed, so the notification is retried once the reset has finished. Fixes: c0431e1aecdb ("drm/amdgpu/userq: create the same workaround of oversubscription timer") Signed-off-by: Prike Liang <Prike.Liang@amd.com> Cc: Eric Huang <jinhuieric.huang@amd.com> Reviewed-by: Eric Huang <jinhuieric.huang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 6c7eee33c1487ed68a41d9d0a5bd932ad32b15d1) Cc: stable@vger.kernel.org
4 daysdrm/amdkfd: use the queue's process info for the WPTR BO eviction fenceJesse Zhang
amdgpu_amdkfd_map_gtt_bo_to_gart() removes the eviction fence of bo->vm_bo->vm->process_info from the WPTR BO of a new queue. bo->vm_bo is the VM which opened the BO last, not necessarily the KFD process' VM, and a render node VM has no process info. On navi31, an unprivileged process which exports its WPTR BO with AMDKFD_IOC_EXPORT_DMABUF and imports it on a second render node fd oopses in AMDKFD_IOC_CREATE_QUEUE: BUG: kernel NULL pointer dereference, address: 0000000000000060 RIP: 0010:amdgpu_amdkfd_map_gtt_bo_to_gart+0x86/0x1a0 [amdgpu] init_user_queue.part.0+0x180/0x250 [amdgpu] pqm_create_queue+0x32d/0x730 [amdgpu] kfd_ioctl_create_queue+0x583/0x9f0 [amdgpu] Pass the process info of the queue instead. With the fix, the queue is created and destroyed normally. Fixes: 7f347e3f8217 ("drm/amdkfd: Fix NULL pointer error for GC 11.0.1 on mGPU") Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 6b4157498a176bd1c6083f6bb5aaf8a257a2027e) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: keep the CS user fence BO in GTTJesse Zhang
The CS ioctl hands the GPU the GART address of the user fence BO, but since the BO keeps its own preferred and allowed domains, it no longer makes sure the BO is in GTT. A user fence in a VRAM BO, which only needs to be a page in size, gets its address from amdgpu_bo_gpu_offset(), which warns about non-contiguous VRAM. On navi31, a CS with a user fence in a 4K VRAM BO, or in one created with AMDGPU_GEM_CREATE_VM_ALWAYS_VALID: WARNING: amdgpu_object.c:1531 at amdgpu_bo_gpu_offset+0x86/0xb0 [amdgpu], CPU#11: cs_gem_checks/18393 RIP: 0010:amdgpu_bo_gpu_offset+0x86/0xb0 [amdgpu] Call Trace: <TASK> amdgpu_cs_parser_bos.isra.0+0x4eb/0x850 [amdgpu] amdgpu_cs_ioctl+0x97e/0x2510 [amdgpu] drm_ioctl_kernel+0xac/0x110 [drm] drm_ioctl+0x2c6/0x5b0 [drm] __x64_sys_ioctl+0xa0/0xf0 do_syscall_64+0xa3/0x4d0 entry_SYSCALL_64_after_hwframe+0x76/0x7e and BOs which can't be in GTT at all, like GWS or OA ones of a page in size, pass the checks as well. Only take BOs which can't be anywhere else than in GTT as user fence, which the CS then validates there along with its other BOs. While at it, detect userptrs with amdgpu_ttm_tt_is_userptr(); amdgpu_ttm_tt_get_usermm() returns NULL once the task which created the userptr is gone. v2: only take BOs which can only be in GTT instead of special casing the user fence BO in the validation, use amdgpu_ttm_tt_is_userptr() (Christian) Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f16989def9561d04d0f2e77216f5319112d29bf1) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: parse CS IBs at the BO offset their VA mapping starts atJesse Zhang
For rings which parse or patch the IBs on the CPU, like JPEG and VCN, the CS looks the IB up through its VA mapping and maps the BO, but ignores the offset in the BO the mapping starts at. It then parses other data than the GPU executes. On navi31, an IB of JPEG NOPs in the second page of a BO, mapped with offset_in_bo 4096, is parsed from the zeros in the first page and rejected: amdgpu 0000:03:00.0: Invalid packet [0x00000000]! while the same IB submitted through a mapping of the whole BO works. Add the mapping offset when locating the IB in the BO. Fixes: 4802ce117786 ("drm/amdgpu: fix UVD/VCE VM emulation") Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 74ba1d87d67d0a38d8248928241c3e1c73d0d53b) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: sign extend the addresses GEM_OP(GET_MAPPING_INFO) returnsJesse Zhang
GEM_VA takes the GPU virtual addresses above the VA hole sign extended, like the rest of the UAPI, but GET_MAPPING_INFO reports them without the upper bits, so they land in the hole. Mappings in the upper half of the address space can't be recreated or removed with what it returns. On navi31: MAP at 0xffff800100000000 -> 0 GET_MAPPING_INFO -> addr 0x800100000000 UNMAP at 0x800100000000 -> -EINVAL Sign extend the addresses before handing them out. Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP ioctl") Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 9d5524a339390da9145b19bfb40da45640332fb3) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: skip RAS error count reset in debug modeCe Sun
After legacy ACA support was retired, some ASICs systems may trigger security violations during driver load when amdgpu_ras_reset_error_count() is invoked in debug mode. The function only checks whether RAS is supported for the target block before proceeding. In debug mode, ACA/RAS handling is not available and attempting to access the reset path can lead to unexpected HW accesses, resulting in security violation reports during driver initialization. Prevent this by treating debug mode as unsupported for RAS error count reset and return -EOPNOTSUPP early. Fixes: af1ae7d0beaf ("drm/amdgpu: retire legacy ACA support") Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit af6b6f1a14dca860468b0fe2a55b7194702d5fa0) Cc: stable@vger.kernel.org
4 daysdrm/amdgpu: only tear down an active UALink acceleratorMukul Joshi
AMDGPU_UALINK_ACCEL_STATE_ERROR is ordered after ACTIVE, so the "state < ACTIVE" check in deactivate_accelerator() lets an accelerator in the error state through to the full teardown. The NPA VM and workqueue are only created when the accelerator is activated, and an accelerator in the error state either never got there (invalid pPod or vPod configuration) or was already deactivated on the config update error path. Tearing it down again calls destroy_workqueue() on a NULL or freed npa_wq and amdgpu_vm_fini() on an uninitialized or freed NPA VM. This is reachable from driver unload (hw_fini), a later failing config update, removal from the vPod and a pPod setup commit. Only deactivate an accelerator that is actually active. Fixes: 0e8eb0dcea51 ("drm/amdgpu: Assign accel state based on ASP config") Signed-off-by: Mukul Joshi <mukul.joshi@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 0abb988dd7162e56e66e36c55780035be7d34b94)
4 daysdrm/amdgpu: Check cs flags.Bas Nieuwenhuizen
Had no validation before. libdrm_amdgpu memsets this, even for the raw/raw2 functions. We have a lot of functions touching the ioctl struct, no strong opinion on where this is placed, but I thought early would be good. Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl> Reviewed-by: Faith Ekstrand <faith.ekstrand@collabora.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 4d01e15e76358f60ef6734462d2b6d9972b9dfbc) Cc: stable@vger.kernel.org
9 daysMerge tag 'drm-next-2026-10-31' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "The final set of merge window fixes, from AMD mostly. with one set of panthor mmu fixes. amdgpu: - UALink fixes - Runtime PM fixes - GPUVM fixes - Mac fixes - HDMI fixes - DP MST fix - Userptr fix - SMU fixes - DSC fix - VCE/UVD sched teardown fix - Display runpm reference fix - Display TD-LUT fix - SMU 13.x fixes - SMU 14.x fixes - Gang submit fix - Passive DVI sink fix - USB4 tunnel fix - Freesync fix amdkfd: - SVM fixes - Fix doorbell allocation race - GC 12.1 fix - GPU reset fix - Buffer accounting fixes - Bounds checking fixes - Hotplug fixes - SVM fixes - CRIU fixes - GFX12 fix panthor: - Fix bugs in MMU handling" * tag 'drm-next-2026-10-31' of https://gitlab.freedesktop.org/drm/kernel: (52 commits) drm/amd/display: refresh cached HDMI FreeSync state drm/amd/display: Cap DSC bpp for USB4 DP tunnels drm/amd/display: Poll passive DVI sinks for EDID readiness drm/amdgpu: re-enable GFXOFF for compute on GFX12 drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO drm/amdgpu: drop the gang leader reference when freeing gang jobs drm/amdkfd: send SMI process and VM fault events only to allowed clients drm/amdkfd: validate SRAT subtables before parsing drm/amd/pm: preserve committed OD features for SMU 14.0.2 drm/amd/pm: add zero fan stop temperature support on smu 14.0.2 drm/amd/pm: preserve committed OD features for SMU 13.0.0/13.0.7 drm/amd/display: Initialize missing TD-LUT programming inputs drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping drm/amdgpu: reject CS chunks too large for kvmalloc() drm/amd/display: take a runtime PM reference only when a CRTC turns on drm/amdgpu: guard VCE/UVD sched entity teardown on failed probe drm/amdkfd: stop restore retries on device unplug drm/amdkfd: tear down KFD processes before early fini_sw on disconnect drm/amdkfd: Validate the control stack of a restored queue drm/amdkfd: correct vram_available calculation ...
11 daysMerge tag 'platform-drivers-x86-v7.4-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: "The usual updates for laptop quirks from HP, ASUS, Acer, Dell etc: - new model names and recent CPU support - more special button / function key handling - battery and hardware monitoring quirks Tool updates to intel-speed-select WMI now supports non-x86 architectures Miscellaneous cleanups / refactoring / improvements" * tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (237 commits) platform/x86: asus-wmi: name the TUF keyboard RGB state and speed codes platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming platform/x86: asus-wmi: rename TUF RGB state DEVID to _CMD platform/x86: asus-armoury: add power limits quirk for GU605CM platform/x86: asus-armoury: add power limits quirk for G533QS platform/x86: asus-armoury: add power limits quirk for GA402NV platform/x86: asus-armoury: add power limits quirk for FA608UP platform/x86: asus-armoury: add power limits quirk for FA608UH platform/x86: asus-armoury: add power limits quirk for FA608PM platform/x86: asus-armoury: add power limits quirk for G713QR platform/x86: ibm_rtl: Fix potential OOB read at signature search platform/x86: acer-wmi: Add support for Acer Nitro AN16-41 platform/x86: acer-wmi: Cycle platform profile on mode key 0x4 platform/x86: hp-wmi: Disable hwmon attributes when no fans are usable platform/x86: gpd pocket fan: Cancel work before releasing GPIOs platform/x86: asus-armoury: Add XBOX ROG Ally X 20 Tunables platform/x86: msi-wmi: Ignore WMI events for keys also handled by atkbd platform/x86: msi-wmi: Sort scancodes numerically platform: arm64: Add a driver for the EC found on ASUS Glymur machines MAINTAINERS: Add myself as a LENOVO drivers co-maintainer ...
12 daysdrm/amdgpu: re-enable GFXOFF for compute on GFX12Harkirat Gill
Commit 2affe2bbc997 ("drm/amdgpu: disable gfxoff with the compute workload on gfx12") disabled GFXOFF whenever a user-mode compute queue exists, as a workaround for an OpenCL test failure. The MES firmware issue behind that failure has since been addressed, so the workaround is no longer required. Without this change, idle inference servers that hold a context for hours never let the graphics block power down, costing roughly 3-4% reported GPU activity and ~3 W per GPU at idle. Measured on gfx1200 with an idle HIP process holding one stream and two resident KFD queues: before: VDDGFX 695 mV, GPU load 2%, ~9-10 W after: VDDGFX 35 mV, GPU load 0%, ~8 W (idle baseline) The resident queue count is unchanged in both cases; only GFXOFF availability differs. The ocltst runtime suite (40 tests) passes with and without this change. Fixes: 2affe2bbc997 ("drm/amdgpu: disable gfxoff with the compute workload on gfx12") Signed-off-by: Harkirat Gill <harkirat.gill@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f6d97ecb68b8623da2f83997a9c8c57a1a9649f9)
12 daysdrm/amdgpu: drop the gang leader reference when freeing gang jobsJesse Zhang
Every job of a gang except the leader holds a reference to the scheduled fence of the leader in job->gang_submit. Only amdgpu_job_free(), used for jobs which never ran, drops it, so for every gang submission which completes the scheduler fence of the leader, and with it its hardware fence, is leaked. amdgpu_job_free() in turn checks for the leader only after drm_sched_job_cleanup() cleared the scheduler fence, so a leader freed there drops a reference it never took. On navi31, 100 submissions of a GFX + COMPUTE gang grow the slab cache drm_sched_fence is merged into by 60 to 180 objects each time, while 100 GFX only submissions don't. Use amdgpu_job_free() for the jobs the scheduler frees too, and check for the gang leader there before drm_sched_job_cleanup() clears the scheduler fence. As the scheduler clears the entity of the jobs it picked up, check for the scheduler fence instead to tell whether the job needs cleaning up. Keep freeing the remaining IBs with amdgpu_job_free_resources() after drm_sched_job_cleanup(), so that it frees them with the hardware fence or right away and not with the scheduler fence, which nobody signals for jobs aborted after drm_sched_job_arm(), like a CS returning -EAGAIN. v2: unify amdgpu_job_free() and amdgpu_job_free_cb() (Christian), don't free the remaining IBs with the scheduler fence v3: drop the comments (Christian) v4: free the IBs with amdgpu_job_free_resources() again (Christian) Fixes: 68ce8b242242 ("drm/amdgpu: add gang submit backend v2") Fixes: f7d66fb2ea43 ("drm/amdgpu: cleanup scheduler job initialization v2") Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit df4d6d404d44bbc8fc850bc7f9f136a25dabf180) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: reject CS chunks too large for kvmalloc()Jesse Zhang
The CS ioctl copies every chunk with vmemdup_array_user() before it looks at it, for whatever length_dw userspace gives. kvmalloc() warns about allocations above INT_MAX when called without __GFP_NOWARN, so any process with the render node can trigger a warning. On navi31, a CS with a chunk of length_dw 0x20000000 returns -ENOMEM after: WARNING: mm/slub.c:6841 at __kvmalloc_node_noprof+0x5a5/0x7d0 Reject such chunks with -EINVAL before trying to copy them. Fixes: 2098105ec65c ("drm: drop drm_[cm]alloc* helpers") Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit dab5f5280406088591645f499f048dcfefab8d7d) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: guard VCE/UVD sched entity teardown on failed probeOlivier Kaloudoff
Since commit 037b98a2312e ("drm/amdgpu: move UVD and VCE sched entity init after sched init"), drm_sched_entity_init() for the VCE and UVD kernel entities runs in the scheduler-init phase, well after the IP-block sw_init phase has allocated the vcpu_bos. If probe fails between the two phases, amdgpu_device_fini_sw() still runs the per-IP sw_fini callbacks for blocks that did complete sw_init. Both amdgpu_vce_sw_fini() and amdgpu_uvd_sw_fini() then call drm_sched_entity_destroy() on an entity that was never initialized: entity->rq is NULL and drm_sched_entity_flush() dereferences it, oopsing in whatever context drove the failed probe. The hole was latent-but-safe until commit 2df5efb45425 ("drm/sched: Remove redundant entity->rq initialization and checks") removed the if (!entity->rq) early return that commit 1decbf6bb0b4 ("drm/sched: Fix entities with 0 rqs.") had put in drm_sched_entity_flush(), on the grounds that entity->rq can never be NULL. That holds only for entities that completed drm_sched_entity_init() — not for the never-initialized entity this teardown path reaches. Observed on real hardware: MI50 (Vega20, VCE 4.0 / UVD 7.2) behind a Thunderbolt link — a pciehp presence/link-change event re-probes the device; when the re-probe fails (-EINVAL here), the cleanup path NULL-derefs inside drm_sched_entity_flush() in the pciehp IRQ thread and takes the whole machine down (panic_on_oops, EFI pstore capture). Reproduced twice on 7.3-rc5, 2026-10-06 and 2026-10-09, identical signature; the faulting instruction is `mov (%rax),%r15` on rax = entity->rq == NULL, i.e. `sched = entity->rq->sched`: BUG: kernel NULL pointer dereference RIP: drm_sched_entity_flush+0x34/0x2d0 [gpu_sched] drm_sched_entity_destroy amdgpu_vce_sw_fini vce_v4_0_sw_fini amdgpu_device_fini_sw ... pciehp_configure_device pciehp_handle_presence_or_link_change Guard the entity teardown on entity->rq, which is set only by drm_sched_entity_init(). amdgpu_ring_fini() already self-guards via the rings[] registration, and the vcpu_bo/firmware cleanup still runs as before. v2: retarget Fixes: at commit 2df5efb45425 ("drm/sched: Remove redundant entity->rq initialization and checks") — the !entity->rq check from commit 1decbf6bb0b4 ("drm/sched: Fix entities with 0 rqs.") that Alex pointed to was removed by it in the 7.3 window, so this is a regression there, not a pre-existing hole. Fixes: 2df5efb45425 ("drm/sched: Remove redundant entity->rq initialization and checks") Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Philipp Stanner <phasta@kernel.org> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 3ad55d18f468fa81be725301d1e138ecd5148e6a) Cc: stable@vger.kernel.org
12 daysdrm/amdkfd: stop restore retries on device unplugOlivier Kaloudoff
amdgpu_amdkfd_restore_userptr_worker() and svm_range_restore_work() reschedule themselves when validation fails with evicted objects pending. After a surprise removal the restore paths fail with -ENODEV permanently, so rescheduling just spins the worker uselessly until cancel_delayed_work_sync() in fini finally stops it - which can take a while, since process teardown itself is delayed by the dead device. Treat -ENODEV as terminal in both workers. Cc: Xiaogang Chen <xiaogang.chen@amd.com> Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com> Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 266fab83139600e58db7e900e930c722e619b78c) Cc: stable@vger.kernel.org
12 daysdrm/amdkfd: tear down KFD processes before early fini_sw on disconnectOlivier Kaloudoff
On surprise removal, amdgpu_device_fini_hw() calls amdgpu_amdkfd_device_fini_sw() when pci_dev_is_disconnected() is true. fini_sw frees kfd.dev, but KFD processes may still be alive and hold references to it: kfd_process_destroy() dereferences kfd.dev via kfd_processes_remove(), and svm_range_list_fini() / kfd_process_free_outstanding_kfd_bos() touch per-device SVM state. The kfd_processes_count wait only happens later in kgd2kfd_teardown_processes(), called from the top-half remove path well after fini_sw. In the observed failure the killed KFD process (SIGBUS on unplug) stuck in D state on its exit path, so kfd_processes_count never drained and the PCIe removal thread wedged permanently in cond_resched(), producing soft-lockup and hung-task splats. Tear KFD processes down before freeing kfd.dev on the disconnect path, and guard kgd2kfd_teardown_processes() against kfd.dev already being gone when it runs a second time. Cc: Xiaogang Chen <xiaogang.chen@amd.com> Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com> Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 836f44ba87ed7b1d83e2b7bfc788f8c6437b03a7) Cc: stable@vger.kernel.org
2026-10-23Merge tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm updates from Dave Airlie: "Highlights: - core: a lot of atomic refactoring in progress, panic got split into a core/helpers model - amdgpu: enables HDMI 2.1 FRL and other good things finally, UAlink over Ethernet support - xe: has a bunch of CRI support, ras error for bad vram, memory offlining support. - msm: enables a bunch more GPUs. Otherwise it's a the usual mountain of stuff all over the place. Details: rust: - I/O tree shared with driver-core - DMA tree shared with driver-core - allow aux registration data closures to return covariant sub-fields - Implement Send and Sync for MapleTree - add pci resource flags and IORESOURCE_MEM_64 drm/rust: - add dma_fence abstraction - init DRM registrations and their data in place - drop unused flags argument to registration vgaarb: - rework API to pass a private ptr instead of pci device sound: - adapt to omapdrm changes gem: - add callback for handle count going to 0 gpusvm: - share one HMM fault and keep single mappings inline pagemap: - Prevent CPU stalls during unbounded pagemap teardown dma-fence: - fix docs vga_switcheroo: - disconnect from fbcon - update fbcon from within fbdev emulation atomic: - move DRM from state reset callbacks to atomic_create_state - remove drm_simple_encoder_init panic: - split into core and helpers buddy: - improve dirty tracking clients: - improve vmap handling - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko display: - export HDMI SCDC status data via debugfs - rework SCDC for better HDMI 2.0 support - dp/mst: improve DPCD compliance edid: - parse AMD VSDB - parse ALLM/VRR capabilities - support detecting panel size log: - add drm_warn_ratelimited sched: - cleanup interface - add missing locking - fix run-queue cleanup - fix locking sysfb: - remove obsolete quirk for Lenovo D330 - fix panel orientation for non-native display modes - drop drm_class_device_register colorop: - provide DRM_COLOR_OP_FIXED_MATRIX bridge: - analogix: Support eDP lane mapping - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84 - Select DRM_PANEL_BRIDGE for various drivers that require it - add chrontel ch7218a support panel: - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001 - samsung-s6d16d0: Use mipi_dsi_*_multi() functions - support Ilitek ILI7836A OLED plus DT bindings - support Novatek NT36532 plus DT bindings - convert several drivers to managed cleanup - fix Kconfig selections - edp: - Add support for BOE NV140FHM-T0A - Support CSOT MNE007QB1-1 - NV140WU2-M70 - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization - samsung: Share test-key helpers - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE DV215FHM-R01 plus DT bindings - Refactor struct drm_panel to contain struct drm_bridge plus fallout in various panel drivers - Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO B140HAN04.0, AUO 0x0db3, panels. amdgpu: - use AMD VSDB for freesync - implement YUV-to-RGB with fixed-matrix colorop - enable FRL for HDMI - HDMI 2.1 freesync support - HDMI 2.1 ALLM support - HDMI 2.1 VRR support - UALoE (UALink over Ethernet) support - add syncobj_points to userq signal ioctl - drop unused kunit tests - NBIO/GC/MMHUB/SMU updates/fixes - GPU spatial partitioning updates - display kunit fixes - userq fixes - RGB quantization fixes - DC RMCM refactor - DP MST fixes - USB4 fixes - add new trace events - Rework display instance handling - stack frame size fixes for various compilers/configs - VCN 4/5 reset fixes - freesync updates - cursor refactor - Fix direct scanout alpha on some DRM_FORMATs - Expand Mac reserved memory workaround - Make runtime pm more fine grained amdkfd: - updates and fixes - GC 10 CU occupancy support radeon: - eDP fix for DCE3.2 iMacs xe: - add drm_ras netlink error event support - add memory page offlining support - introduce error threshold to drm_ras - fix stale GTT mappings on unmap - reject page faults for non-page fault mode scratch VM - enable CRI package and VRAM temperatures - introduce cold reset recovery - handle CRI+ power interval encoding - VF migration for multi-queue - handle exec queue teardown after hot unplug - alerts and controller enabling modifications - use IBCv3 on PTL - VRAM health check - report GT TDR and VM rebind faults using SIGID - add multi_queue_active_lrca debugfs - shrinker: Runtime PM reference for non-system memory - guc: Add simple KLV decoder helpers - debugfs: Expose per-engine idle status - Keep walking on SVM eviction failure - Nuke PTs only after unlinking contested VMAs - limit sg segment size to PAGE_SIZE on Xen PV - keep VF LMEM bar size low if no VFs - CPU binds and ULLS on migration queue - New PTL PCI ID - Enable PXP for NVL-S - Do not dma_fence_put zero fences in err_out path - Refresh TTM LRU on SVM prefetch - export device UID in sysfs i915: - rename GEN6_PCODE_DATA to match spec - fix incorrect RCU teardown order - fix potential UAF in command parsing - avoid WARN splat during RPS boosting race - use simpler min functions - Fixes to make i915 work well with PREEMPT_RT i915/display: - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path - Switch DG2 MPLL to DPLL framework - DP-HDMI PCON DSC fixes - limit invalid joiner combinations - CDCLK related fixes and refactor around PCODE integration - Gate UHBR SST SDP splitting on sink caps - add HDMI TMDS audio bandwidth check - vswing/preemph override - enable AS SDP Skip frames - Handle negative configuration index on DP link caps for robustness - Preparation for enabling SDR plane color pipeline - An eDP quirk for HP Pavilion Plus - Introduce PME (Power Management Event) support on display hotplug - Handle VSC SDP revision 7 in unpack msm: - CI: - Dropped sc7180 trogdor lazor from the CI - Core: - Fixed msm_ioremap for resources without a name - Changed msm.separate_gpu_kms to default to auto selection - GPU: - Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding limits on CX/GX rails - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85 (Mahua) - Fix VBIF halt mask on a306, which was preventing runpm suspend - Enable THP support for GEM buffers - Add modparam to disable waiting on fences in shrinker - Drop use of drm_prime_sg_to_page_array() - a5xx: don't read the GPMU registers on GPUs without a GPMU - a2xx/a3xx/a5xx: hangcheck progress detection - a6xx: gmuwrapper runpm fix - Calculate reported GMEM size based on active slices - Split a6xx/a7xx/a8xx catalog - DP: - Picked up some preparation patches for the MST support - Fixed reported status of the link training - DPU: - Fixed CRTC bandwidth computation - Fixed DSC programming - Fixed encoder disablement path - DSI: - Fixed VM leak in error path - Indention fix - MDP5: - Added MSM8952 configuration - Dropped incorrect cursor pipe on MSM8976/56 - HDMI: - Small fixes nouveau: - improve runtime PM on R570 GSP firmware - various fixes throughout the driver - dispnv50: support 2.147 GHz pixel clock in GB20x nova: - add initial uapi concept - add initial PRAMIN access support - add GpuMm centralized memory manager - add GPU VM and BAR1 support - add GPU interrupts and GSP events support - GSP messaging fixes tyr: - use bitfield! - zero unsupported and newly added GPU info fields - limit doorbell array to 17 entries exynos: - FIMD fixes - Fix clock leak on resume error path - Fix Sparse warnings by adding missing __iomem annotation - VIDI cleanup - Replace kmalloc() and copy_from_user() with memdup_user() amdxdna: - fix BO handling - Support AIE2 rev 9 - Fix UAF access in scheduler fences - Update workqueue interface - expose busy time via fdinfo ast: - support 256-byte EDID hyperv_drm: - remove support for pre win10 hosts komeda: - fix GLB_CORE_ID usage omap: - report HDMI hotplug events to ASoC HDMI codec panthor: - provide gpu_cache_flush tracepoint - improve dma_fence signalling latency - improve locking - export scheduling information via debugfs - Validate user-space input against firmware limits qaic: - reject BOs that exceed maximum page count - add missing include statements verisilicon: - fix hardware cursor offsets vkms: - implement YUV-to-RGB with fixed-matrix colorop gma500: - avoid unsupported ARGB formats in primary plane hibmc: - handle vblank interrupts correctly ivpu: - add DRM_IVPU_CAP_CMDQ_SET_PRIORITY - support command-queue priority ioctl - Simplify NULL-pointer handling in cleanup code arcpgu: - replace simple-display pipeline with regular atomic helpers aspeed: - replace simple-display pipeline with regular atomic helpers gm12u320: - replace simple-display pipeline with regular atomic helpers imagination: - various improvement to firmware interaction - add job to pvr_job_submit_fw trace event mali-dp: - fix runtime PM leak mcde: - replace simple-display pipeline with regular atomic helpers p111: - replace simple-display pipeline with regular atomic helpers - drop unsupported alpha formats from primary plane rcar-du: - support Renesas R-Car V4H DSC - dsi: Support larger transfers with AXI memory - Support RZ/G3L SoC repaper: - replace simple-display pipeline with regular atomic helpers rockchip: - dsi: improve PHY timings ssd130x: - support Solomon SSD1351 OLED plus DT bindings - ssd133x: upgrade color format to RGB565 - ssd132x: Set correct hardware window when clearing screen tve200: - replace simple-display pipeline with regular atomic helpers xen: - replace simple-display pipeline with regular atomic helpers v3d: - improve job handling under perfmon vc4: - reliably reset V3D - drop brcm,vc4-v3d compatible virtio: - fix damage handling - Support ARGB8888 for virtio primary planes. host1x: - Support partitioning imx: - Replace simple-display with regular atomic helpers mxsfb: - Support bus formats plus DT bindings tegra: - improve syncobj handling on submit panfrost: - add Mali-G68 support - improve GPU reset handling rockchip: - add HDMI 2.0 support to dw-hdmi-qp - improve HPD handling" * tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel: (2324 commits) drm/adp: Switch to drm_atomic_helper_connector_create_state drm/malidp: Convert to atomic_create_state drm/vc4: Switch to drm_atomic_helper_connector_create_state drm/sysfb: Switch to drm_atomic_helper_connector_create_state drm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_state drm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_state drm/hyperv: Switch to drm_atomic_helper_connector_create_state drm/bridge: megachips: Switch to drm_atomic_helper_connector_create_state drm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_state drm/arm: komeda: Switch to drm_atomic_helper_connector_create_state drm/appletbdrm: Fix incorrect error message on encoder attach failure drm/sun4i: hdmi: Convert to drmm_connector_hdmi_init() drm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilities drm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilities drm/bridge: ite-it66121: Advertise HDMI 1.2 capabilities drm/bridge: ite-it6263: Advertise HDMI 1.3 capabilities drm/bridge: ite-it6263: Drop redundant .mode_valid hook drm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilities drm/bridge: adv7511: Advertise HDMI 1.2 capabilities drm/sched: Document entity->stopped is protected by entity->lock ...
2026-10-23Merge tag 'iommu-updates-v7.4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull IOMMU updates from Joerg Roedel: "Core: - Detect scatterlist length overflows and finalize deferred domain attachments before mapping MSI pages - Consolidate x86 MSI reserved-region handling and clean up internal DMA and SVA helpers AMD IOMMU: - Add IOMMU PerfOpt support, enabled by amdgpu for supported integrated GPUs in identity domains - Restrict forced identity mapping to GPUs that require it - Fix kdump device-table allocation and reuse, ATS configuration error handling, and an interrupt-remapping allocation leak - Clean up device probing and initialization - Add Vasant Hegde as an AMD IOMMU maintainer ARM SMMUv2: - Device-tree binding updates for Qualcomm Maili and Nord SoCs ARM SMMUv3: - Work around hardware integration issue on Google Tensor G5 SoCs where all DMA transactions appear as instruction fetches - Allow command queue size to be configured on the kernel command-line - Reduce queue sizes when running as a kdump kernel - Fix some pre-existing issues in the driver and kunit tests reported by Sashiko - Fix handling of Arm hardware errata relating to the contiguous hint when using SVA - Rework the TLB invalidation logic in preparation for enabling iommu-pt in future - Minor cleanups in preparation for improving support for kdump Apple DART: - Support device-tree DMA aperture specifications Broadcom: - Add BCM2712 IOMMU support for Raspberry Pi 5 display and multimedia devices, including the generic page-table format and shared TLB cache management Hyper-V: - Add a para-virtualized guest IOMMU driver with guest-managed stage-1 page tables and page-selective IOTLB invalidation Intel VT-d: - Enhanced IQE fault handling for batched multiple descriptors, - Optimization of page-table level calculation in compute_vasz_lg2_ss(), - Fixes for several pre-existing issues reported by Sashiko, - General cleanup and refinement RISC-V: - Report cache-coherency capability for coherent devices, enabling VFIO/iommufd use Samsung Exynos: - Support SysMMUs without BLOCK mode, fixing their enable sequence and TLB invalidation - Improve v7 fault diagnostics with transaction information" * tag 'iommu-updates-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (69 commits) MAINTAINERS: Make Vasant Hegde AMD IOMMU maintainer iommu/hyperv: Make hv_iommu_device static iommu/hyperv: Add missing PCI dependency for the guest IOMMU driver iommu/amd: Don't allocate kdump device table from DMA32 iommu/amd: Program device table when kdump reuse fails iommu/dma: Clean up redundant MSI cookie check iommu/dma: Catch scatterlist length overflows iommu/hyperv: Add page-selective IOTLB flush support iommu/hyperv: Add para-virtualized IOMMU support for Hyper-V guest iommu/x86: Add architectural MSI reserved region helper Drivers: hv: Add logical device ID registry for vPCI devices hyperv: Introduce new hypercall interfaces used by Hyper-V guest IOMMU iommu: Make iommu-dma helpers private iommu/arm-smmu-v3: Don't rb_erase() a never-inserted stream node iommu/arm-smmu-v3: Add Q_POS() macro iommu/arm-smmu-v3: Add arm_smmu_attach_release() iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown iommu/arm-smmu-v3: Populate the tlbi at the top of the call chain iommu/arm-smmu-v3: Precompute the invalidation commands iommu/arm-smmu-v3: Keep track in arm_smmu_invs if range invalidation is used ...
2026-10-23Merge tag 'vfio-v7.4-rc1' of https://github.com/awilliam/linux-vfioLinus Torvalds
Pull VFIO updates from Alex Williamson: - Fix missing selftest <libgen.h> include for basename() to support non-glibc builds (Hisam Mehboob) - Add vfio selftest documentation covering the libvfio helper library and guidance for developers to aid in adding and understanding the framework (David Matlack) - Fix vfio cdev open path to prevent a second open from clobbering the vf_token or clearing the KVM reference. Add a selftest to avoid future recurrences (Alex Williamson) - Extend vfio selftest mix_and_match timeouts, in particular to account for systems where generated faults can induce heavy SMM load, delaying internal timeouts. Also extend timeout for execution via runner to account for various tests exceeding default 45s timeout (Alex Williamson) - Add tracking for non-reserved mappings into a vfio_dma object in order to optimize the tear-down paths where per-page tests can be entirely skipped. This resolves a soft lockup for large memory GPUs (Samuel Crossley) - Add vfio selftest driver for mlx5, providing another target for exercising DMA and interrupts against a physical device (Jason Gunthorpe) - Hardening against read-only region promotion, preserving vm_pgoff for unmap_mapping_range(), and reject non-shared MMIO mmaps as necessary through vfio-platform, vfio-fsl-mc, and vfio-cdx. These prevent future issues, though none are currently reachable (Abdifatah Suruur) - Fix 8-byte ioeventfd support, removing a static error test that was erroneously left in place when generalizing 8-byte io accesses (Li RongQing) - Fix missed RCU drain on module exit (Jiale Yao) - Fix off-by-one boundary check in migration support within the mlx5 vfio-pci variant driver (Seongjun Hong) - Remove drvdata usage convention across vfio-pci-core, allowing variant drivers to freely create their own conventions and enabling a future Rust-based variant driver. A DRM topic branch is also merged in support of this effort, modifying the vga arbiter API to more cleanly remove the drvdata dependency (Simon Song) - Fix hisi_acc vfio-pci variant driver to avoid NULL pointer accesses when bound to unsupported devices and also disabling migration support when running on 64K host page size due to BAR mapping constraints (Longfang Liu) - Add device IDs for Crescent Island and Nova Lake devices to the Xe vfio-pci variant driver (Satyanarayana K V P) - Fix fallback mode in nvgrace-gpu variant driver to use symmetric open and close handlers to avoid reported use-after-free issue. Remove the resulting unnecessary test in the now single-purpose open function (Andrea Parri) * tag 'vfio-v7.4-rc1' of https://github.com/awilliam/linux-vfio: (35 commits) vfio/nvgrace-gpu: Drop the usemem length check in open_device vfio/nvgrace-gpu: Use a core-only open_device in fallback mode vfio/xe: Add CRI and NVL device IDs hisi_acc_vfio_pci: reject live migration on 64KB page with QM_HW_V3 hardware hisi_acc_vfio_pci: fix NULL dereference in reset_prepare on PF passthrough vfio/pci: Remove the core dependency on driver data vfio/mlx5: Fix boundary check in set_report_output() vfio/pci: Drain eventfd RCU callbacks on module exit PCI/VGA: pass a data pointer to be used in the decode callback (v2) vfio/pci: Restore 8-byte ioeventfd support vfio/cdx: reject non-shared MMIO mmaps vfio/cdx: keep logical vm_pgoff in MMIO region mmap vfio/fsl-mc: keep logical vm_pgoff in MMIO region mmap vfio/platform: keep logical vm_pgoff in MMIO region mmap vfio/cdx: prevent read-only region mappings from becoming writable vfio/fsl-mc: prevent read-only region mappings from becoming writable vfio/platform: prevent read-only region mappings from becoming writable vfio: selftests: Verify a failed second open preserves the vf_token vfio: selftests: mlx5 driver - add send_msi support vfio: selftests: Add mlx5 driver - data path and memcpy ops ...
2026-10-20drm/amdkfd: correct vram_available calculationZhen Han
reserve_mem_limit() computes available VRAM as vram_size - reserved - vram_pin_size - kfd.vram_used However, kfd.vram_used already includes BOs that are later pinned. Pinning does not consume extra VRAM. Subtracting vram_pin_size counts those bytes twice and causes fake-OOM while VRAM is still free. Reuse get_available_memory() in reserve_mem_limit(). Move ALIGN_DOWN to the ioctl so the userspace ABI is unchanged. The VRAM counter is a parameter: the ioctl passes vram_used_aligned[], the gate passes vram_used[] so a 4K BO is not charged 2MB. kfd.vram_pinned is only updated in gpuvm_pin_bo(). dma-buf pin calls amdgpu_bo_pin() only, so the counter stays zero. Update it from amdgpu_bo_pin() through a KFD helper, on first pin and last unpin, matching vram_pin_size. Track per-XCP pins in vram_pin_size_xcp[] and kfd.vram_pinned[]. Pins that are not owned by a single partition go to vram_pin_size_common, which every partition subtracts. A KFD VRAM BO always carries a partition, so the KFD credit is only correct for xcp >= 0. Call the helper for both branches and let it warn once and skip if that ever stops holding: without the credit the BO would be subtracted through vram_pin_size_common and never added back, which is the double counting this patch removes, and kfd.vram_pinned[] would be indexed out of bounds. Suggested-by: Philip Yang <Philip.Yang@amd.com> Signed-off-by: Zhen Han <Zhen.Han@amd.com> Reviewed-by: Mukul Joshi <mukul.joshi@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 894cbb31c50e3cf49657130396bbf6c0475304e4) Cc: stable@vger.kernel.org
2026-10-20drm/amdgpu: skip the PASID TLB fence for the UALink NPA VMHoratio Zhang
amdgpu_vm_make_npa() builds the UALink NPA VM on top of amdgpu_vm_make_compute(), which unconditionally sets need_tlb_fence. That flag makes amdgpu_vm_tlb_flush() queue an asynchronous PASID based TLB invalidation after every page table update. The NPA VM is created by the driver itself in amdgpu_ualink_manager_start() and never gets a PASID assigned, so vm->pasid stays 0, which MES cannot resolve on the MMHUB. The invalidation never completes and MES stays unresponsive for the rest of the probe: amdgpu: MES(0, 0) failed to respond to msg=INVALIDATE_TLBS The invalidation is not needed in the first place. An NPA VM is bound to the reserved NPA VMID and amdgpu_ualink_flush_tlb() already invalidates that VMID on the MMHUB after every mapping change. Clear need_tlb_fence for NPA VMs. Fixes: e05a54573df7 ("drm/amdgpu: Pin page tables in NPA VMs") Signed-off-by: Horatio Zhang <hongkun.zhang@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit e419e52cad769df45f496b7621841b25b63235da)
2026-10-20amdkfd: Fix memory availability double accounting of kfd pinned objectsDaniel Phillips
Pinned objects that are not kfd objects reduce the total vram available to kfd, so we subtract the total size of pinned objects from kdf vram availability. However this double counts objects pinned by kfd itself, because they are counted both as used and pinned. So track the total size of objects pinned by kfd and add it back to kfd availability to remove the double accounting. Signed-off-by: Daniel Phillips <daniel.phillips@amd.com> Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b8257bdb26ca5d9a75f4b81f629422f17afa221b) Cc: stable@vger.kernel.org
2026-10-20drm/amdgpu: wait for pending page table updates before switching a VM to CPU ↵John Fisher
updates amdgpu_vm_make_compute() switches a VM from SDMA to CPU page table updates when a KFD process acquires it. It syncs "with the last SDMA update/clear" through amdgpu_bo_sync_wait() on the root PD, but that walks the reservation with DMA_RESV_USAGE_READ, and the clears of the VM's page tables (the root PD from amdgpu_vm_init(), and the PDs/PTs the seq64 mapping allocates at the render node's open) are added there by amdgpu_vm_sdma_commit() with DMA_RESV_USAGE_BOOKKEEP only: amdgpu_vm_pt_clear() commits them with a NULL fence, so they do not reach vm->last_update. The CPU path's own waits (amdgpu_vm_cpu_update(), amdgpu_bo_kmap()) use DMA_RESV_USAGE_KERNEL. None of them waits for a clear that is still queued. When one is, the CPU writes the first entries of the new compute VM (the KFD trap handler's TBA/TMA page at AMDGPU_VA_RESERVED_TRAP_START, mapped during ACQUIRE_VM) into a page directory the SDMA then clears. The entries are gone, the handler's page is unmapped, and the first wave save of any queue of the process faults in the SQC instruction fetch at the handler's address (GCVM_L2_PROTECTION_FAULT_STATUS 0x008012B1, PERMISSION_FAULTS 0xb). The MES then fails REMOVE_QUEUE and SUSPEND, and the device takes a MODE1 reset with VRAM lost on 7.2.9; on 7.3-rc6 the queue is reset instead. The window is the time between the render node's open and ACQUIRE_VM. ROCr spends milliseconds there and is practically never hit; a minimal KFD client that opens the render node and acquires the VM at once is hit most of the time. On a Radeon AI PRO R9700 (gfx1201, Resizable BAR, so vm_update_mode defaults to CPU updates for compute VMs), a wave reading the trap handler's page right after queue creation found it unmapped in 8 of 12 runs; a 5 ms sleep between the open and ACQUIRE_VM made that 0 of 9, and the same sleep after queue creation instead 3 of 3. The wait covered these jobs until commit 926c79ad6ecd ("drm/amdgpu: promote the implicit sync to the dependent read fences") narrowed amdgpu_sync_resv() from DMA_RESV_USAGE_BOOKKEEP to DMA_RESV_USAGE_READ; the VM's page table jobs have been added with BOOKKEEP since commit 4247084057cf ("drm/amdgpu: use DMA_RESV_USAGE_BOOKKEEP v2"), so from v6.16 on the sync in amdgpu_vm_make_compute() waits for nothing of them. Record the clears in vm->last_update, as amdgpu_vm_update_pdes() does with its updates, and wait for it, uninterruptibly, before switching the update functions. The clears all go through vm->delayed, so the last one covers the earlier ones; immediate clears are not recorded, as before. With this, on 7.3-rc6 and on 7.2.9, the same client reads the handler 10 of 10 times, 8 busy queues on the 4 compute slots complete in 5 of 5 runs on 7.3-rc6 and 3 of 3 on 7.2.9 (1 of 6 before), 16 and 32 queues complete on 7.3-rc6, and two processes with 8 queues each complete together on both, with no fault. Fixes: 926c79ad6ecd ("drm/amdgpu: promote the implicit sync to the dependent read fences") Cc: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: John Fisher <jfisher84@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 9ec91b35baba45209c3fcd00f086224a158dd512) Cc: stable@vger.kernel.org # v6.16+
2026-10-20drm/amdgpu/gmc9: add extra type-2 TLB flush for gfx942/gfx950Elena Sakhnovitch
Add extra type-2 TLB flush for GC 9.5.0, similar race condition was observed as Vega20+XGMI. Add to GC 9.4.3 and 9.4.4 too, as they share the same multi-XCD TLB topology. Reported-by: Shahzeb Ahmed <shahzeb.ahmed@amd.com> Reported-by: Manjunath Gaonkar <Manjunath.Gaonkar@amd.com> Signed-off-by: Elena Sakhnovitch <Elena.Sakhnovitch@amd.com> Reviewed-by: Apurv Mishra <apurv.mishra@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 138cfb165ae6aa98c0767b431e718d1a8199db28) Cc: stable@vger.kernel.org
2026-10-20drm/amdkfd: fix NULL deref in SDMA HQD debugfs dump on GC 12.1Harish Kasiviswanathan
Reading the KFD HQD debugfs node (dqm_debugfs_hqds) on a gc_12_1_0 part oopses with a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: hqd_sdma_dump_v12_1+0x6a [amdgpu] Call Trace: dqm_debugfs_hqds+0x2da/0x360 [amdgpu] kfd_debugfs_hqds_by_device+0x74/0xa0 [amdgpu] seq_read ... __x64_sys_read get_sdma_rlc_reg_offset() assumes an interleaved layout where the second SDMA per XCC lives in a separate SDMA1_HWIP register aperture. On gc_12_1_0 that aperture does not exist. Rewrite get_sdma_rlc_reg_offset() to mirror sdma_v7_1_get_reg_offset(): base the offset on adev->reg_offset[GC_HWIP][xcc_id][0] and add the per-instance SDMA1 offset for the odd instance. Fixes: 7bd5d763b8e1 ("drm/amdkfd: Add gfx_v12_1_kfd2kgd interface for GFX12_1") Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com> Reviewed-by: Mukul Joshi <mukul.joshi@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 94b2c5b06d37adc0e9a23138252758657b64b58a) Cc: stable@vger.kernel.org
2026-10-20drm/amd/pm: reapply umd profile state after recoveryKevin Wang
Resume and full GPU reset retain the selected UMD profile level in driver state. The GFX and PMFW state behind it is reinitialized. Add a generic DPM reapply path after CG and PG restoration. It restores the UMD GFX state and asks the PM backend to replay the retained level. v2: - Reapply only GFX CG to preserve the profile-owned GFX PG reference. - Fall back to AUTO when reapply fails without failing device recovery. - Propagate PowerPlay DPM errors before accepting AUTO fallback. - Limit workload-profile error reporting to the swSMU reapply path. This covers: - PCI runtime resume - Full GPU reset recovery - System resume, including S3 and s2idle Signed-off-by: Kevin Wang <kevin.wang@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit fd0699fc9f4266fc07d6ce6dbb484fac04601106) Cc: stable@vger.kernel.org
generated by cgit v1.2.3 (git 2.0.4) at 2026-11-08 15:12:57 +0000