summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/amd
AgeCommit message (Collapse)Author
40 hoursMerge tag 'drm-next-2026-10-31' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "The final set of merge window fixes, from AMD mostly. with one set of panthor mmu fixes. amdgpu: - UALink fixes - Runtime PM fixes - GPUVM fixes - Mac fixes - HDMI fixes - DP MST fix - Userptr fix - SMU fixes - DSC fix - VCE/UVD sched teardown fix - Display runpm reference fix - Display TD-LUT fix - SMU 13.x fixes - SMU 14.x fixes - Gang submit fix - Passive DVI sink fix - USB4 tunnel fix - Freesync fix amdkfd: - SVM fixes - Fix doorbell allocation race - GC 12.1 fix - GPU reset fix - Buffer accounting fixes - Bounds checking fixes - Hotplug fixes - SVM fixes - CRIU fixes - GFX12 fix panthor: - Fix bugs in MMU handling" * tag 'drm-next-2026-10-31' of https://gitlab.freedesktop.org/drm/kernel: (52 commits) drm/amd/display: refresh cached HDMI FreeSync state drm/amd/display: Cap DSC bpp for USB4 DP tunnels drm/amd/display: Poll passive DVI sinks for EDID readiness drm/amdgpu: re-enable GFXOFF for compute on GFX12 drm/amdkfd: evict the queues only once for CRIU PROCESS_INFO drm/amdgpu: drop the gang leader reference when freeing gang jobs drm/amdkfd: send SMI process and VM fault events only to allowed clients drm/amdkfd: validate SRAT subtables before parsing drm/amd/pm: preserve committed OD features for SMU 14.0.2 drm/amd/pm: add zero fan stop temperature support on smu 14.0.2 drm/amd/pm: preserve committed OD features for SMU 13.0.0/13.0.7 drm/amd/display: Initialize missing TD-LUT programming inputs drm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mapping drm/amdgpu: reject CS chunks too large for kvmalloc() drm/amd/display: take a runtime PM reference only when a CRTC turns on drm/amdgpu: guard VCE/UVD sched entity teardown on failed probe drm/amdkfd: stop restore retries on device unplug drm/amdkfd: tear down KFD processes before early fini_sw on disconnect drm/amdkfd: Validate the control stack of a restored queue drm/amdkfd: correct vram_available calculation ...
4 daysMerge tag 'platform-drivers-x86-v7.4-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Ilpo Järvinen: "The usual updates for laptop quirks from HP, ASUS, Acer, Dell etc: - new model names and recent CPU support - more special button / function key handling - battery and hardware monitoring quirks Tool updates to intel-speed-select WMI now supports non-x86 architectures Miscellaneous cleanups / refactoring / improvements" * tag 'platform-drivers-x86-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (237 commits) platform/x86: asus-wmi: name the TUF keyboard RGB state and speed codes platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming platform/x86: asus-wmi: rename TUF RGB state DEVID to _CMD platform/x86: asus-armoury: add power limits quirk for GU605CM platform/x86: asus-armoury: add power limits quirk for G533QS platform/x86: asus-armoury: add power limits quirk for GA402NV platform/x86: asus-armoury: add power limits quirk for FA608UP platform/x86: asus-armoury: add power limits quirk for FA608UH platform/x86: asus-armoury: add power limits quirk for FA608PM platform/x86: asus-armoury: add power limits quirk for G713QR platform/x86: ibm_rtl: Fix potential OOB read at signature search platform/x86: acer-wmi: Add support for Acer Nitro AN16-41 platform/x86: acer-wmi: Cycle platform profile on mode key 0x4 platform/x86: hp-wmi: Disable hwmon attributes when no fans are usable platform/x86: gpd pocket fan: Cancel work before releasing GPIOs platform/x86: asus-armoury: Add XBOX ROG Ally X 20 Tunables platform/x86: msi-wmi: Ignore WMI events for keys also handled by atkbd platform/x86: msi-wmi: Sort scancodes numerically platform: arm64: Add a driver for the EC found on ASUS Glymur machines MAINTAINERS: Add myself as a LENOVO drivers co-maintainer ...
5 daysdrm/amd/display: refresh cached HDMI FreeSync stateFangzhi Zuo
When an HDMI sink re-reports an EDID without an AMD VSDB, get_amd_vsdb() returns false but the connector's cached vsdb_info was previously updated only on success. A previous FreeSync-capable EDID could therefore leave freesync_supported set and keep selecting the FreeSync SPD path instead of the HDMI VRR VTEM path. Refresh the cached VSDB record for every HDMI EDID update so a missing AMD VSDB clears stale FreeSync state. Keep the existing SPD/VTEM packet separation and protocol-selection logic unchanged. Fixes: 123e9515f7e0 ("drm/amd/display: Send HDMI VRR metadata in VTEM info packet slot") Reviewed-by: IVAN LIPSKI <ivan.lipski@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: PeiHsin Yang <peihsiny@valvesoftware.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 732a165000944e618ed38769922daf11b0fe35eb) Cc: stable@vger.kernel.org
5 daysdrm/amd/display: Cap DSC bpp for USB4 DP tunnelsFangzhi Zuo
On pre-DCN4.2 platforms, USB4 DP bandwidth allocation is unavailable. SST and MST streams are sized against their native DP link bandwidth even when multiple DP tunnels share the host router. A high-bandwidth DSC stream can consume too much shared tunnel capacity and cause intermittent display corruption when another tunnel is active. Cap the DSC target at 8 bpp for USB4 DPIA SST and MST streams when bandwidth allocation is unavailable. For MST, cap the DSC fairness range while preserving its per-link allocation. When bandwidth allocation is enabled on DCN4.2, retain forced DSC and the existing minimum-bpp behavior required to fit the tunnel grant. This is a follow-up to commit c30b9813bce1 ("drm/amd/display: Force DSC to 8bpp for SST DP tunneling over USB4") and commit cd53dcd2a7d7 ("drm/amd/display: Force DSC to 8bpp for MST DP tunneling over USB4"). Reviewed-by: Ivan Lipski <ivan.lipski@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit e2bd5d908a89252ad4ee11a3dbc9fd57c257accd)
5 daysdrm/amd/display: Poll passive DVI sinks for EDID readinessFangzhi Zuo
A passive DP-DVI adapter is identified when the adapter DDC probe does not respond, but the downstream monitor's EDID EEPROM may still need time to become available after resume. Poll the downstream DDC address for passive DP-DVI links before reading and parsing the EDID. Keep the eDP detection optimization without adding a generic EDID retry delay or a deferred connector reprobe. Revert commit 3001d2073d65 ("drm/amd/display: Exit IPS before connector detection on resume") and rely on targeted passive DP-DVI EDID readiness polling instead of the generic pre-detection IPS exit. Fixes: d1d51519bc3b ("drm/amd/display: Skip eDP detection when no sink") Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Fangzhi Zuo <jerry.zuo@amd.com> Signed-off-by: Tom Chung <chiahsuan.chung@amd.com> Tested-by: Karthikeyan B <karthikeyan.b@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 8297e1c724733fc59027b717df73680eaf03dd56) Cc: stable@vger.kernel.org
5 daysdrm/amdgpu: re-enable GFXOFF for compute on GFX12Harkirat Gill
Commit 2affe2bbc997 ("drm/amdgpu: disable gfxoff with the compute workload on gfx12") disabled GFXOFF whenever a user-mode compute queue exists, as a workaround for an OpenCL test failure. The MES firmware issue behind that failure has since been addressed, so the workaround is no longer required. Without this change, idle inference servers that hold a context for hours never let the graphics block power down, costing roughly 3-4% reported GPU activity and ~3 W per GPU at idle. Measured on gfx1200 with an idle HIP process holding one stream and two resident KFD queues: before: VDDGFX 695 mV, GPU load 2%, ~9-10 W after: VDDGFX 35 mV, GPU load 0%, ~8 W (idle baseline) The resident queue count is unchanged in both cases; only GFXOFF availability differs. The ocltst runtime suite (40 tests) passes with and without this change. Fixes: 2affe2bbc997 ("drm/amdgpu: disable gfxoff with the compute workload on gfx12") Signed-off-by: Harkirat Gill <harkirat.gill@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f6d97ecb68b8623da2f83997a9c8c57a1a9649f9)
5 daysdrm/amdkfd: evict the queues only once for CRIU PROCESS_INFOJesse Zhang
criu_process_info() evicts the queues of the process on every call, and each kfd_process_evict_queues() increments qpd->evicted, but CRIU UNPAUSE restores them only once. After PROCESS_INFO twice and UNPAUSE the queues stay evicted for good. On navi31, a barrier-AND packet on an HSA queue completes after PROCESS_INFO + UNPAUSE, but times out after PROCESS_INFO, PROCESS_INFO, UNPAUSE. The error path has a related problem: when kfd_process_evict_queues() itself fails, it has already rolled back its partial eviction, and the kfd_process_restore_queues() in the error path restores once more. Evict only when the queues are not paused yet, and on errors only undo an eviction done by this call. The barrier now completes after any number of PROCESS_INFO calls followed by UNPAUSE. Fixes: cd9f79103003 ("drm/amdkfd: CRIU Implement KFD unpause operation") Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 4d79c9e3c32c677fcadf5ca10ab81ee0a4b81f99) Cc: stable@vger.kernel.org
5 daysdrm/amdgpu: drop the gang leader reference when freeing gang jobsJesse Zhang
Every job of a gang except the leader holds a reference to the scheduled fence of the leader in job->gang_submit. Only amdgpu_job_free(), used for jobs which never ran, drops it, so for every gang submission which completes the scheduler fence of the leader, and with it its hardware fence, is leaked. amdgpu_job_free() in turn checks for the leader only after drm_sched_job_cleanup() cleared the scheduler fence, so a leader freed there drops a reference it never took. On navi31, 100 submissions of a GFX + COMPUTE gang grow the slab cache drm_sched_fence is merged into by 60 to 180 objects each time, while 100 GFX only submissions don't. Use amdgpu_job_free() for the jobs the scheduler frees too, and check for the gang leader there before drm_sched_job_cleanup() clears the scheduler fence. As the scheduler clears the entity of the jobs it picked up, check for the scheduler fence instead to tell whether the job needs cleaning up. Keep freeing the remaining IBs with amdgpu_job_free_resources() after drm_sched_job_cleanup(), so that it frees them with the hardware fence or right away and not with the scheduler fence, which nobody signals for jobs aborted after drm_sched_job_arm(), like a CS returning -EAGAIN. v2: unify amdgpu_job_free() and amdgpu_job_free_cb() (Christian), don't free the remaining IBs with the scheduler fence v3: drop the comments (Christian) v4: free the IBs with amdgpu_job_free_resources() again (Christian) Fixes: 68ce8b242242 ("drm/amdgpu: add gang submit backend v2") Fixes: f7d66fb2ea43 ("drm/amdgpu: cleanup scheduler job initialization v2") Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit df4d6d404d44bbc8fc850bc7f9f136a25dabf180) Cc: stable@vger.kernel.org
5 daysdrm/amdkfd: send SMI process and VM fault events only to allowed clientsJesse Zhang
Commit 92a8dba246d3 ("drm/amdkfd: fix SMI event cross-process information leak") made the VMFAULT and PROCESS_START/END SMI events carry the pid of the process they are about, so that kfd_smi_ev_enabled() only passes them to clients of that process and to privileged clients. Commit 1142738572ef ("drm/amdkfd: Fix SMI event PID reporting for containers") then switched kfd_smi_event_add() to take a task and passed NULL for these events, i.e. pid 0, which every client receives again. On navi31, an unprivileged SMI client (uid 1000) subscribed to PROCESS_START/END sees root running rocminfo: event: c 223a9 rocminfo event: d 223a9 rocminfo The same commit also made the filter compare PIDs of different namespaces: the client stores its PID in its own namespace and events use the PID of the task in the task's namespace, so a client that is PID 1 in one container receives the events of PID 1 in another. And an exited task has no PID in its namespace anymore, which gives pid 0 for PROCESS_END. Match clients by global TGID, which is unique and stays valid after the task exited, and keep showing the namespace PID in the event text. Pass the TGID of the process for the process and VM fault events again. With this the unprivileged client gets nothing, a root client still gets both events, and an unprivileged client that is PID 1 in its own PID namespace no longer gets the events of rocminfo running as PID 1 in another one. v2: rename the pid of the clients and of the filter to tgid (Felix) Fixes: 1142738572ef ("drm/amdkfd: Fix SMI event PID reporting for containers") Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 77f5f4eae104a96399a5b1003730d5d739368b7d) Cc: stable@vger.kernel.org
5 daysdrm/amdkfd: validate SRAT subtables before parsingJiale Yao
The KFD SRAT walker reads the first subtable length without checking that a header is present and trusts subsequent lengths when accessing CPU and generic affinity records. Invalid firmware lengths can therefore cause out-of-bounds reads. Validate the table header, every generic subtable range, and each supported typed record before reading its fields. Fixes: ddec8d3be0f8 ("drm/amdkfd: add ACPI SRAT parsing for topology") Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jiale Yao <yaojiale02@163.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit d76b655c98e8cc9e791b31502ad274f47dee2aae) Cc: stable@vger.kernel.org
5 daysdrm/amd/pm: preserve committed OD features for SMU 14.0.2Kevin Wang
PMFW treats FeatureCtrlMask as the complete set of active OD features. Uploads containing only newly edited bits can drop earlier settings. Fix the OD state handling to: - preserve committed features across later commits - keep fan-curve and legacy-fan bits mutually exclusive - keep staged OD settings out of power-cap writes - update cached state only after successful uploads - clear restored features only after they return to defaults - restore PPT for the current AC/DC source after resume Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/3625 Signed-off-by: Kevin Wang <kevin.wang@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 8d4ce79aff1cd1ff4feea4967c30e04eb6be8c2d) Cc: stable@vger.kernel.org
5 daysdrm/amd/pm: add zero fan stop temperature support on smu 14.0.2Kenneth Feng
add zero fan stop temperature support on smu 14.0.2 Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5905 Signed-off-by: Kenneth Feng <kenneth.feng@amd.com> Reviewed-by: Kevin Wang <kevin.wang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f990c94a2633d0ead477eb1b174e254a6d292e66) Cc: stable@vger.kernel.org
5 daysdrm/amd/pm: preserve committed OD features for SMU 13.0.0/13.0.7Kevin Wang
PMFW treats FeatureCtrlMask as the complete set of active OD features. Uploads containing only newly edited bits can drop earlier settings. Fix the OD state handling to: - preserve committed features across later commits - keep staged OD settings out of power-cap writes - update cached state only after successful uploads - clear restored features only after they return to defaults - restore PPT for the current AC/DC source after resume Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/3625 Signed-off-by: Kevin Wang <kevin.wang@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Tested-by: José Miguel Sarasola <alosarjos@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit adf63026e1fa706de48d986ac6c1a7cb64cbf927) Cc: stable@vger.kernel.org
5 daysdrm/amd/display: Initialize missing TD-LUT programming inputsAvi Weiss
dml_core_mode_programming() memsets (clears) its scratch structure before calculating TD-LUT settings, but does not initialize tdlut_mpc_width_flag or is_gfx11. Both inputs therefore remain false regardless of the plane configuration which can result in incorrect calculations. Initialize both fields using the same sources as the mode support path (now both paths are aligned). Fixes: 70839da63605 ("drm/amd/display: Add new DCN401 sources") Signed-off-by: Avi Weiss <thnkslprpt@gmail.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit ad8d216e7d9fc050cdf39278e5fae17f61c36931) Cc: stable@vger.kernel.org
5 daysdrm/amdkfd: split vram_pages of SVM ranges prefetched without a GPU mappingJesse Zhang
When an SVM range is split, svm_range_split_pages() gives the new range the number of VRAM pages counted in its part of the dma_addr arrays and subtracts it from the old range. Pages migrated to VRAM by a prefetch have no dma_addr entries until the range is mapped on a GPU, e.g. with no ACCESS attribute, or with XNACK off before the delayed restore worker mapped it, so the new range gets 0 and the old one keeps the count for both. Migrating the parts back to system memory then gets the accounting wrong: the old part keeps a VRAM page count after all its pages are gone, so its svm_bo is never freed, and the new part underflows. On navi31, as an unprivileged process: prefetch 4 MiB to the GPU, prefetch the upper 2 MiB and then the lower 2 MiB back to system memory: Recorded vram pages(0x0) should not be less than migration pages(0x200). WARNING: ../amdkfd/kfd_migrate.c:922 at svm_migrate_vram_to_ram+0xbdc/0xcd0 [amdgpu] and /sys/class/kfd/kfd/proc/<pid>/vram_<gpu_id> stays at 4194304 until the process exits. Without dma_addr arrays, the split is still exact when the old range is completely in VRAM, which is what a prefetch of the whole range leaves. Give the new range all its pages in that case. The warning is gone and the VRAM usage drops back to 0. This doesn't cover a range that is only partly in VRAM without dma_addr arrays, e.g. after a partial migration, since svm_migrate_ram_to_vram() only counts the pages it actually migrated. That would need VRAM residency to be tracked per page independently of dma_addr. v2: - Rename counted to has_dma_addr and compare against old->npages (Philip) - Mention the XNACK off case and the partial migration limitation (Philip) Fixes: 006ad514a50c ("drm/amdkfd: Use partial hmm page walk during buffer validation in SVM") Reviewed-by: Philip Yang <philip.yang@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 7ca6f3359b557a267c7b07a2fd748b1473395e10) Cc: stable@vger.kernel.org
5 daysdrm/amdgpu: reject CS chunks too large for kvmalloc()Jesse Zhang
The CS ioctl copies every chunk with vmemdup_array_user() before it looks at it, for whatever length_dw userspace gives. kvmalloc() warns about allocations above INT_MAX when called without __GFP_NOWARN, so any process with the render node can trigger a warning. On navi31, a CS with a chunk of length_dw 0x20000000 returns -ENOMEM after: WARNING: mm/slub.c:6841 at __kvmalloc_node_noprof+0x5a5/0x7d0 Reject such chunks with -EINVAL before trying to copy them. Fixes: 2098105ec65c ("drm: drop drm_[cm]alloc* helpers") Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit dab5f5280406088591645f499f048dcfefab8d7d) Cc: stable@vger.kernel.org
5 daysdrm/amd/display: take a runtime PM reference only when a CRTC turns onLuigi Lauro
amdgpu_dm_commit_streams() takes a runtime PM reference for every active CRTC that needs a modeset and has a new stream, but amdgpu_dm_atomic_commit_tail() drops one only for each CRTC that goes from active to inactive. A modeset of a CRTC that is already active (a mode change, or anything else that needs a full modeset) therefore leaks one reference. Once that has happened, the usage count no longer returns to zero with every CRTC off, and the device cannot runtime suspend again until reboot. The two also disagree the other way when a CRTC turns on without a stream ("Failed to create new stream"): no reference is taken, but one is dropped when it turns off. Take the reference in the loop that counts the disabled CRTCs, on the mirror condition: when the CRTC goes from inactive to active, which is what the commit that added it intended ("every time we enable a previously disabled CRTC"). Each active CRTC then holds exactly one reference. Tested on an RX 9070 XT (Navi 48) over OCuLink, with the change backported to 7.2.9: an unplugged connector forced on, then mode A on a CRTC, mode B on the same active CRTC, and the CRTC off, three rounds in a row. The usage count rose by 3 with the stock module, by 0 with this patch, and by 3 again after reloading the stock module. Fixes: 97028037a38a ("drm/amdgpu: Grab/put runtime PM references in atomic_commit_tail()") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5951 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Luigi Lauro <luigi.lauro@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 59ef9a435499777b8e1c4e0eff52f813c64fb920) Cc: stable@vger.kernel.org
5 daysdrm/amdgpu: guard VCE/UVD sched entity teardown on failed probeOlivier Kaloudoff
Since commit 037b98a2312e ("drm/amdgpu: move UVD and VCE sched entity init after sched init"), drm_sched_entity_init() for the VCE and UVD kernel entities runs in the scheduler-init phase, well after the IP-block sw_init phase has allocated the vcpu_bos. If probe fails between the two phases, amdgpu_device_fini_sw() still runs the per-IP sw_fini callbacks for blocks that did complete sw_init. Both amdgpu_vce_sw_fini() and amdgpu_uvd_sw_fini() then call drm_sched_entity_destroy() on an entity that was never initialized: entity->rq is NULL and drm_sched_entity_flush() dereferences it, oopsing in whatever context drove the failed probe. The hole was latent-but-safe until commit 2df5efb45425 ("drm/sched: Remove redundant entity->rq initialization and checks") removed the if (!entity->rq) early return that commit 1decbf6bb0b4 ("drm/sched: Fix entities with 0 rqs.") had put in drm_sched_entity_flush(), on the grounds that entity->rq can never be NULL. That holds only for entities that completed drm_sched_entity_init() — not for the never-initialized entity this teardown path reaches. Observed on real hardware: MI50 (Vega20, VCE 4.0 / UVD 7.2) behind a Thunderbolt link — a pciehp presence/link-change event re-probes the device; when the re-probe fails (-EINVAL here), the cleanup path NULL-derefs inside drm_sched_entity_flush() in the pciehp IRQ thread and takes the whole machine down (panic_on_oops, EFI pstore capture). Reproduced twice on 7.3-rc5, 2026-10-06 and 2026-10-09, identical signature; the faulting instruction is `mov (%rax),%r15` on rax = entity->rq == NULL, i.e. `sched = entity->rq->sched`: BUG: kernel NULL pointer dereference RIP: drm_sched_entity_flush+0x34/0x2d0 [gpu_sched] drm_sched_entity_destroy amdgpu_vce_sw_fini vce_v4_0_sw_fini amdgpu_device_fini_sw ... pciehp_configure_device pciehp_handle_presence_or_link_change Guard the entity teardown on entity->rq, which is set only by drm_sched_entity_init(). amdgpu_ring_fini() already self-guards via the rings[] registration, and the vcpu_bo/firmware cleanup still runs as before. v2: retarget Fixes: at commit 2df5efb45425 ("drm/sched: Remove redundant entity->rq initialization and checks") — the !entity->rq check from commit 1decbf6bb0b4 ("drm/sched: Fix entities with 0 rqs.") that Alex pointed to was removed by it in the 7.3 window, so this is a regression there, not a pre-existing hole. Fixes: 2df5efb45425 ("drm/sched: Remove redundant entity->rq initialization and checks") Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Cc: Philipp Stanner <phasta@kernel.org> Cc: Alex Deucher <alexander.deucher@amd.com> Cc: Christian König <christian.koenig@amd.com> Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 3ad55d18f468fa81be725301d1e138ecd5148e6a) Cc: stable@vger.kernel.org
5 daysdrm/amdkfd: stop restore retries on device unplugOlivier Kaloudoff
amdgpu_amdkfd_restore_userptr_worker() and svm_range_restore_work() reschedule themselves when validation fails with evicted objects pending. After a surprise removal the restore paths fail with -ENODEV permanently, so rescheduling just spins the worker uselessly until cancel_delayed_work_sync() in fini finally stops it - which can take a while, since process teardown itself is delayed by the dead device. Treat -ENODEV as terminal in both workers. Cc: Xiaogang Chen <xiaogang.chen@amd.com> Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com> Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 266fab83139600e58db7e900e930c722e619b78c) Cc: stable@vger.kernel.org
5 daysdrm/amdkfd: tear down KFD processes before early fini_sw on disconnectOlivier Kaloudoff
On surprise removal, amdgpu_device_fini_hw() calls amdgpu_amdkfd_device_fini_sw() when pci_dev_is_disconnected() is true. fini_sw frees kfd.dev, but KFD processes may still be alive and hold references to it: kfd_process_destroy() dereferences kfd.dev via kfd_processes_remove(), and svm_range_list_fini() / kfd_process_free_outstanding_kfd_bos() touch per-device SVM state. The kfd_processes_count wait only happens later in kgd2kfd_teardown_processes(), called from the top-half remove path well after fini_sw. In the observed failure the killed KFD process (SIGBUS on unplug) stuck in D state on its exit path, so kfd_processes_count never drained and the PCIe removal thread wedged permanently in cond_resched(), producing soft-lockup and hung-task splats. Tear KFD processes down before freeing kfd.dev on the disconnect path, and guard kgd2kfd_teardown_processes() against kfd.dev already being gone when it runs a second time. Cc: Xiaogang Chen <xiaogang.chen@amd.com> Signed-off-by: Olivier Kaloudoff <olivier.kaloudoff@gmail.com> Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 836f44ba87ed7b1d83e2b7bfc788f8c6437b03a7) Cc: stable@vger.kernel.org
5 daysdrm/amdkfd: Validate the control stack of a restored queueWilliam Palacek
kfd_criu_restore_queue() takes the control stack size from the checkpoint image without the topology check create-queue does in kfd_queue_acquire_buffers(), which restore stopped calling in commit 1cafa8b29e02 ("drm/amdkfd: Don't acquire buffers during CRIU queue restore."). An image size of 0x300000 is accepted and sizes the MQD allocation, and 0xFFFFFFFF trips a page allocator warning in kmalloc(). restore_mqd() also keeps the image's cp_hqd_cntl_stack_size, cp_hqd_cntl_stack_offset and cp_hqd_wg_state_offset. With offset > size or wave state offset < size, get_wave_state() returns wrapped sizes. Take the per-XCC size from topology, 0 for queues without a control stack, and reject larger images. In restore_mqd(), set the size to it and bound both offsets as init_mqd() does. Fixes: 626f7b3190b4 ("drm/amdkfd: CRIU add queues support") Fixes: 42c6c48214b7 ("drm/amdkfd: CRIU checkpoint and restore queue mqds") Signed-off-by: William Palacek <William.Palacek@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 92249023caee17bfc6f29c71d6aaa5f2298cf507) Cc: stable@vger.kernel.org
8 daysMerge tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm updates from Dave Airlie: "Highlights: - core: a lot of atomic refactoring in progress, panic got split into a core/helpers model - amdgpu: enables HDMI 2.1 FRL and other good things finally, UAlink over Ethernet support - xe: has a bunch of CRI support, ras error for bad vram, memory offlining support. - msm: enables a bunch more GPUs. Otherwise it's a the usual mountain of stuff all over the place. Details: rust: - I/O tree shared with driver-core - DMA tree shared with driver-core - allow aux registration data closures to return covariant sub-fields - Implement Send and Sync for MapleTree - add pci resource flags and IORESOURCE_MEM_64 drm/rust: - add dma_fence abstraction - init DRM registrations and their data in place - drop unused flags argument to registration vgaarb: - rework API to pass a private ptr instead of pci device sound: - adapt to omapdrm changes gem: - add callback for handle count going to 0 gpusvm: - share one HMM fault and keep single mappings inline pagemap: - Prevent CPU stalls during unbounded pagemap teardown dma-fence: - fix docs vga_switcheroo: - disconnect from fbcon - update fbcon from within fbdev emulation atomic: - move DRM from state reset callbacks to atomic_create_state - remove drm_simple_encoder_init panic: - split into core and helpers buddy: - improve dirty tracking clients: - improve vmap handling - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko display: - export HDMI SCDC status data via debugfs - rework SCDC for better HDMI 2.0 support - dp/mst: improve DPCD compliance edid: - parse AMD VSDB - parse ALLM/VRR capabilities - support detecting panel size log: - add drm_warn_ratelimited sched: - cleanup interface - add missing locking - fix run-queue cleanup - fix locking sysfb: - remove obsolete quirk for Lenovo D330 - fix panel orientation for non-native display modes - drop drm_class_device_register colorop: - provide DRM_COLOR_OP_FIXED_MATRIX bridge: - analogix: Support eDP lane mapping - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84 - Select DRM_PANEL_BRIDGE for various drivers that require it - add chrontel ch7218a support panel: - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001 - samsung-s6d16d0: Use mipi_dsi_*_multi() functions - support Ilitek ILI7836A OLED plus DT bindings - support Novatek NT36532 plus DT bindings - convert several drivers to managed cleanup - fix Kconfig selections - edp: - Add support for BOE NV140FHM-T0A - Support CSOT MNE007QB1-1 - NV140WU2-M70 - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization - samsung: Share test-key helpers - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE DV215FHM-R01 plus DT bindings - Refactor struct drm_panel to contain struct drm_bridge plus fallout in various panel drivers - Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO B140HAN04.0, AUO 0x0db3, panels. amdgpu: - use AMD VSDB for freesync - implement YUV-to-RGB with fixed-matrix colorop - enable FRL for HDMI - HDMI 2.1 freesync support - HDMI 2.1 ALLM support - HDMI 2.1 VRR support - UALoE (UALink over Ethernet) support - add syncobj_points to userq signal ioctl - drop unused kunit tests - NBIO/GC/MMHUB/SMU updates/fixes - GPU spatial partitioning updates - display kunit fixes - userq fixes - RGB quantization fixes - DC RMCM refactor - DP MST fixes - USB4 fixes - add new trace events - Rework display instance handling - stack frame size fixes for various compilers/configs - VCN 4/5 reset fixes - freesync updates - cursor refactor - Fix direct scanout alpha on some DRM_FORMATs - Expand Mac reserved memory workaround - Make runtime pm more fine grained amdkfd: - updates and fixes - GC 10 CU occupancy support radeon: - eDP fix for DCE3.2 iMacs xe: - add drm_ras netlink error event support - add memory page offlining support - introduce error threshold to drm_ras - fix stale GTT mappings on unmap - reject page faults for non-page fault mode scratch VM - enable CRI package and VRAM temperatures - introduce cold reset recovery - handle CRI+ power interval encoding - VF migration for multi-queue - handle exec queue teardown after hot unplug - alerts and controller enabling modifications - use IBCv3 on PTL - VRAM health check - report GT TDR and VM rebind faults using SIGID - add multi_queue_active_lrca debugfs - shrinker: Runtime PM reference for non-system memory - guc: Add simple KLV decoder helpers - debugfs: Expose per-engine idle status - Keep walking on SVM eviction failure - Nuke PTs only after unlinking contested VMAs - limit sg segment size to PAGE_SIZE on Xen PV - keep VF LMEM bar size low if no VFs - CPU binds and ULLS on migration queue - New PTL PCI ID - Enable PXP for NVL-S - Do not dma_fence_put zero fences in err_out path - Refresh TTM LRU on SVM prefetch - export device UID in sysfs i915: - rename GEN6_PCODE_DATA to match spec - fix incorrect RCU teardown order - fix potential UAF in command parsing - avoid WARN splat during RPS boosting race - use simpler min functions - Fixes to make i915 work well with PREEMPT_RT i915/display: - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path - Switch DG2 MPLL to DPLL framework - DP-HDMI PCON DSC fixes - limit invalid joiner combinations - CDCLK related fixes and refactor around PCODE integration - Gate UHBR SST SDP splitting on sink caps - add HDMI TMDS audio bandwidth check - vswing/preemph override - enable AS SDP Skip frames - Handle negative configuration index on DP link caps for robustness - Preparation for enabling SDR plane color pipeline - An eDP quirk for HP Pavilion Plus - Introduce PME (Power Management Event) support on display hotplug - Handle VSC SDP revision 7 in unpack msm: - CI: - Dropped sc7180 trogdor lazor from the CI - Core: - Fixed msm_ioremap for resources without a name - Changed msm.separate_gpu_kms to default to auto selection - GPU: - Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding limits on CX/GX rails - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85 (Mahua) - Fix VBIF halt mask on a306, which was preventing runpm suspend - Enable THP support for GEM buffers - Add modparam to disable waiting on fences in shrinker - Drop use of drm_prime_sg_to_page_array() - a5xx: don't read the GPMU registers on GPUs without a GPMU - a2xx/a3xx/a5xx: hangcheck progress detection - a6xx: gmuwrapper runpm fix - Calculate reported GMEM size based on active slices - Split a6xx/a7xx/a8xx catalog - DP: - Picked up some preparation patches for the MST support - Fixed reported status of the link training - DPU: - Fixed CRTC bandwidth computation - Fixed DSC programming - Fixed encoder disablement path - DSI: - Fixed VM leak in error path - Indention fix - MDP5: - Added MSM8952 configuration - Dropped incorrect cursor pipe on MSM8976/56 - HDMI: - Small fixes nouveau: - improve runtime PM on R570 GSP firmware - various fixes throughout the driver - dispnv50: support 2.147 GHz pixel clock in GB20x nova: - add initial uapi concept - add initial PRAMIN access support - add GpuMm centralized memory manager - add GPU VM and BAR1 support - add GPU interrupts and GSP events support - GSP messaging fixes tyr: - use bitfield! - zero unsupported and newly added GPU info fields - limit doorbell array to 17 entries exynos: - FIMD fixes - Fix clock leak on resume error path - Fix Sparse warnings by adding missing __iomem annotation - VIDI cleanup - Replace kmalloc() and copy_from_user() with memdup_user() amdxdna: - fix BO handling - Support AIE2 rev 9 - Fix UAF access in scheduler fences - Update workqueue interface - expose busy time via fdinfo ast: - support 256-byte EDID hyperv_drm: - remove support for pre win10 hosts komeda: - fix GLB_CORE_ID usage omap: - report HDMI hotplug events to ASoC HDMI codec panthor: - provide gpu_cache_flush tracepoint - improve dma_fence signalling latency - improve locking - export scheduling information via debugfs - Validate user-space input against firmware limits qaic: - reject BOs that exceed maximum page count - add missing include statements verisilicon: - fix hardware cursor offsets vkms: - implement YUV-to-RGB with fixed-matrix colorop gma500: - avoid unsupported ARGB formats in primary plane hibmc: - handle vblank interrupts correctly ivpu: - add DRM_IVPU_CAP_CMDQ_SET_PRIORITY - support command-queue priority ioctl - Simplify NULL-pointer handling in cleanup code arcpgu: - replace simple-display pipeline with regular atomic helpers aspeed: - replace simple-display pipeline with regular atomic helpers gm12u320: - replace simple-display pipeline with regular atomic helpers imagination: - various improvement to firmware interaction - add job to pvr_job_submit_fw trace event mali-dp: - fix runtime PM leak mcde: - replace simple-display pipeline with regular atomic helpers p111: - replace simple-display pipeline with regular atomic helpers - drop unsupported alpha formats from primary plane rcar-du: - support Renesas R-Car V4H DSC - dsi: Support larger transfers with AXI memory - Support RZ/G3L SoC repaper: - replace simple-display pipeline with regular atomic helpers rockchip: - dsi: improve PHY timings ssd130x: - support Solomon SSD1351 OLED plus DT bindings - ssd133x: upgrade color format to RGB565 - ssd132x: Set correct hardware window when clearing screen tve200: - replace simple-display pipeline with regular atomic helpers xen: - replace simple-display pipeline with regular atomic helpers v3d: - improve job handling under perfmon vc4: - reliably reset V3D - drop brcm,vc4-v3d compatible virtio: - fix damage handling - Support ARGB8888 for virtio primary planes. host1x: - Support partitioning imx: - Replace simple-display with regular atomic helpers mxsfb: - Support bus formats plus DT bindings tegra: - improve syncobj handling on submit panfrost: - add Mali-G68 support - improve GPU reset handling rockchip: - add HDMI 2.0 support to dw-hdmi-qp - improve HPD handling" * tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel: (2324 commits) drm/adp: Switch to drm_atomic_helper_connector_create_state drm/malidp: Convert to atomic_create_state drm/vc4: Switch to drm_atomic_helper_connector_create_state drm/sysfb: Switch to drm_atomic_helper_connector_create_state drm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_state drm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_state drm/hyperv: Switch to drm_atomic_helper_connector_create_state drm/bridge: megachips: Switch to drm_atomic_helper_connector_create_state drm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_state drm/arm: komeda: Switch to drm_atomic_helper_connector_create_state drm/appletbdrm: Fix incorrect error message on encoder attach failure drm/sun4i: hdmi: Convert to drmm_connector_hdmi_init() drm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilities drm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilities drm/bridge: ite-it66121: Advertise HDMI 1.2 capabilities drm/bridge: ite-it6263: Advertise HDMI 1.3 capabilities drm/bridge: ite-it6263: Drop redundant .mode_valid hook drm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilities drm/bridge: adv7511: Advertise HDMI 1.2 capabilities drm/sched: Document entity->stopped is protected by entity->lock ...
9 daysMerge tag 'iommu-updates-v7.4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull IOMMU updates from Joerg Roedel: "Core: - Detect scatterlist length overflows and finalize deferred domain attachments before mapping MSI pages - Consolidate x86 MSI reserved-region handling and clean up internal DMA and SVA helpers AMD IOMMU: - Add IOMMU PerfOpt support, enabled by amdgpu for supported integrated GPUs in identity domains - Restrict forced identity mapping to GPUs that require it - Fix kdump device-table allocation and reuse, ATS configuration error handling, and an interrupt-remapping allocation leak - Clean up device probing and initialization - Add Vasant Hegde as an AMD IOMMU maintainer ARM SMMUv2: - Device-tree binding updates for Qualcomm Maili and Nord SoCs ARM SMMUv3: - Work around hardware integration issue on Google Tensor G5 SoCs where all DMA transactions appear as instruction fetches - Allow command queue size to be configured on the kernel command-line - Reduce queue sizes when running as a kdump kernel - Fix some pre-existing issues in the driver and kunit tests reported by Sashiko - Fix handling of Arm hardware errata relating to the contiguous hint when using SVA - Rework the TLB invalidation logic in preparation for enabling iommu-pt in future - Minor cleanups in preparation for improving support for kdump Apple DART: - Support device-tree DMA aperture specifications Broadcom: - Add BCM2712 IOMMU support for Raspberry Pi 5 display and multimedia devices, including the generic page-table format and shared TLB cache management Hyper-V: - Add a para-virtualized guest IOMMU driver with guest-managed stage-1 page tables and page-selective IOTLB invalidation Intel VT-d: - Enhanced IQE fault handling for batched multiple descriptors, - Optimization of page-table level calculation in compute_vasz_lg2_ss(), - Fixes for several pre-existing issues reported by Sashiko, - General cleanup and refinement RISC-V: - Report cache-coherency capability for coherent devices, enabling VFIO/iommufd use Samsung Exynos: - Support SysMMUs without BLOCK mode, fixing their enable sequence and TLB invalidation - Improve v7 fault diagnostics with transaction information" * tag 'iommu-updates-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (69 commits) MAINTAINERS: Make Vasant Hegde AMD IOMMU maintainer iommu/hyperv: Make hv_iommu_device static iommu/hyperv: Add missing PCI dependency for the guest IOMMU driver iommu/amd: Don't allocate kdump device table from DMA32 iommu/amd: Program device table when kdump reuse fails iommu/dma: Clean up redundant MSI cookie check iommu/dma: Catch scatterlist length overflows iommu/hyperv: Add page-selective IOTLB flush support iommu/hyperv: Add para-virtualized IOMMU support for Hyper-V guest iommu/x86: Add architectural MSI reserved region helper Drivers: hv: Add logical device ID registry for vPCI devices hyperv: Introduce new hypercall interfaces used by Hyper-V guest IOMMU iommu: Make iommu-dma helpers private iommu/arm-smmu-v3: Don't rb_erase() a never-inserted stream node iommu/arm-smmu-v3: Add Q_POS() macro iommu/arm-smmu-v3: Add arm_smmu_attach_release() iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown iommu/arm-smmu-v3: Populate the tlbi at the top of the call chain iommu/arm-smmu-v3: Precompute the invalidation commands iommu/arm-smmu-v3: Keep track in arm_smmu_invs if range invalidation is used ...
9 daysMerge tag 'vfio-v7.4-rc1' of https://github.com/awilliam/linux-vfioLinus Torvalds
Pull VFIO updates from Alex Williamson: - Fix missing selftest <libgen.h> include for basename() to support non-glibc builds (Hisam Mehboob) - Add vfio selftest documentation covering the libvfio helper library and guidance for developers to aid in adding and understanding the framework (David Matlack) - Fix vfio cdev open path to prevent a second open from clobbering the vf_token or clearing the KVM reference. Add a selftest to avoid future recurrences (Alex Williamson) - Extend vfio selftest mix_and_match timeouts, in particular to account for systems where generated faults can induce heavy SMM load, delaying internal timeouts. Also extend timeout for execution via runner to account for various tests exceeding default 45s timeout (Alex Williamson) - Add tracking for non-reserved mappings into a vfio_dma object in order to optimize the tear-down paths where per-page tests can be entirely skipped. This resolves a soft lockup for large memory GPUs (Samuel Crossley) - Add vfio selftest driver for mlx5, providing another target for exercising DMA and interrupts against a physical device (Jason Gunthorpe) - Hardening against read-only region promotion, preserving vm_pgoff for unmap_mapping_range(), and reject non-shared MMIO mmaps as necessary through vfio-platform, vfio-fsl-mc, and vfio-cdx. These prevent future issues, though none are currently reachable (Abdifatah Suruur) - Fix 8-byte ioeventfd support, removing a static error test that was erroneously left in place when generalizing 8-byte io accesses (Li RongQing) - Fix missed RCU drain on module exit (Jiale Yao) - Fix off-by-one boundary check in migration support within the mlx5 vfio-pci variant driver (Seongjun Hong) - Remove drvdata usage convention across vfio-pci-core, allowing variant drivers to freely create their own conventions and enabling a future Rust-based variant driver. A DRM topic branch is also merged in support of this effort, modifying the vga arbiter API to more cleanly remove the drvdata dependency (Simon Song) - Fix hisi_acc vfio-pci variant driver to avoid NULL pointer accesses when bound to unsupported devices and also disabling migration support when running on 64K host page size due to BAR mapping constraints (Longfang Liu) - Add device IDs for Crescent Island and Nova Lake devices to the Xe vfio-pci variant driver (Satyanarayana K V P) - Fix fallback mode in nvgrace-gpu variant driver to use symmetric open and close handlers to avoid reported use-after-free issue. Remove the resulting unnecessary test in the now single-purpose open function (Andrea Parri) * tag 'vfio-v7.4-rc1' of https://github.com/awilliam/linux-vfio: (35 commits) vfio/nvgrace-gpu: Drop the usemem length check in open_device vfio/nvgrace-gpu: Use a core-only open_device in fallback mode vfio/xe: Add CRI and NVL device IDs hisi_acc_vfio_pci: reject live migration on 64KB page with QM_HW_V3 hardware hisi_acc_vfio_pci: fix NULL dereference in reset_prepare on PF passthrough vfio/pci: Remove the core dependency on driver data vfio/mlx5: Fix boundary check in set_report_output() vfio/pci: Drain eventfd RCU callbacks on module exit PCI/VGA: pass a data pointer to be used in the decode callback (v2) vfio/pci: Restore 8-byte ioeventfd support vfio/cdx: reject non-shared MMIO mmaps vfio/cdx: keep logical vm_pgoff in MMIO region mmap vfio/fsl-mc: keep logical vm_pgoff in MMIO region mmap vfio/platform: keep logical vm_pgoff in MMIO region mmap vfio/cdx: prevent read-only region mappings from becoming writable vfio/fsl-mc: prevent read-only region mappings from becoming writable vfio/platform: prevent read-only region mappings from becoming writable vfio: selftests: Verify a failed second open preserves the vf_token vfio: selftests: mlx5 driver - add send_msi support vfio: selftests: Add mlx5 driver - data path and memcpy ops ...
12 daysdrm/amdkfd: correct vram_available calculationZhen Han
reserve_mem_limit() computes available VRAM as vram_size - reserved - vram_pin_size - kfd.vram_used However, kfd.vram_used already includes BOs that are later pinned. Pinning does not consume extra VRAM. Subtracting vram_pin_size counts those bytes twice and causes fake-OOM while VRAM is still free. Reuse get_available_memory() in reserve_mem_limit(). Move ALIGN_DOWN to the ioctl so the userspace ABI is unchanged. The VRAM counter is a parameter: the ioctl passes vram_used_aligned[], the gate passes vram_used[] so a 4K BO is not charged 2MB. kfd.vram_pinned is only updated in gpuvm_pin_bo(). dma-buf pin calls amdgpu_bo_pin() only, so the counter stays zero. Update it from amdgpu_bo_pin() through a KFD helper, on first pin and last unpin, matching vram_pin_size. Track per-XCP pins in vram_pin_size_xcp[] and kfd.vram_pinned[]. Pins that are not owned by a single partition go to vram_pin_size_common, which every partition subtracts. A KFD VRAM BO always carries a partition, so the KFD credit is only correct for xcp >= 0. Call the helper for both branches and let it warn once and skip if that ever stops holding: without the credit the BO would be subtracted through vram_pin_size_common and never added back, which is the double counting this patch removes, and kfd.vram_pinned[] would be indexed out of bounds. Suggested-by: Philip Yang <Philip.Yang@amd.com> Signed-off-by: Zhen Han <Zhen.Han@amd.com> Reviewed-by: Mukul Joshi <mukul.joshi@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 894cbb31c50e3cf49657130396bbf6c0475304e4) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: skip the PASID TLB fence for the UALink NPA VMHoratio Zhang
amdgpu_vm_make_npa() builds the UALink NPA VM on top of amdgpu_vm_make_compute(), which unconditionally sets need_tlb_fence. That flag makes amdgpu_vm_tlb_flush() queue an asynchronous PASID based TLB invalidation after every page table update. The NPA VM is created by the driver itself in amdgpu_ualink_manager_start() and never gets a PASID assigned, so vm->pasid stays 0, which MES cannot resolve on the MMHUB. The invalidation never completes and MES stays unresponsive for the rest of the probe: amdgpu: MES(0, 0) failed to respond to msg=INVALIDATE_TLBS The invalidation is not needed in the first place. An NPA VM is bound to the reserved NPA VMID and amdgpu_ualink_flush_tlb() already invalidates that VMID on the MMHUB after every mapping change. Clear need_tlb_fence for NPA VMs. Fixes: e05a54573df7 ("drm/amdgpu: Pin page tables in NPA VMs") Signed-off-by: Horatio Zhang <hongkun.zhang@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit e419e52cad769df45f496b7621841b25b63235da)
12 daysamdkfd: Fix memory availability double accounting of kfd pinned objectsDaniel Phillips
Pinned objects that are not kfd objects reduce the total vram available to kfd, so we subtract the total size of pinned objects from kdf vram availability. However this double counts objects pinned by kfd itself, because they are counted both as used and pinned. So track the total size of objects pinned by kfd and add it back to kfd availability to remove the double accounting. Signed-off-by: Daniel Phillips <daniel.phillips@amd.com> Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b8257bdb26ca5d9a75f4b81f629422f17afa221b) Cc: stable@vger.kernel.org
12 daysdrm/amd/pm:restate all customized OD features on every table upload for smu ↵Kenneth Feng
13.0.0/smu 14.0.2 PMFW interprets OverDriveTable.FeatureCtrlMask as the complete set of overdrive features that are currently overridden, not as a delta describing the operation at hand. On import it resets every feature whose bit is clear back to its default value - for the VF curve that means zeroing VoltageOffsetPerZoneBoundary[] outright. The driver assumed the opposite. smu_v14_0_2_od_edit_dpm_table() clears the mask after a successful commit, so a subsequent above-default power1_cap write goes through smu_v14_0_2_set_ppt_limit() and uploads a table carrying only PP_OD_FEATURE_PPT_BIT. PMFW then drops the user's voltage offset and reverts to the stock V/F curve, while the driver's cached user table still reports the offset through pp_od_clk_voltage. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5935 Signed-off-by: Kenneth Feng <kenneth.feng@amd.com> Reviewed-by: Kevin Wang <kevin.wang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1b63bb397db208a8f84778a9d9cafc93da9373eb) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: wait for pending page table updates before switching a VM to CPU ↵John Fisher
updates amdgpu_vm_make_compute() switches a VM from SDMA to CPU page table updates when a KFD process acquires it. It syncs "with the last SDMA update/clear" through amdgpu_bo_sync_wait() on the root PD, but that walks the reservation with DMA_RESV_USAGE_READ, and the clears of the VM's page tables (the root PD from amdgpu_vm_init(), and the PDs/PTs the seq64 mapping allocates at the render node's open) are added there by amdgpu_vm_sdma_commit() with DMA_RESV_USAGE_BOOKKEEP only: amdgpu_vm_pt_clear() commits them with a NULL fence, so they do not reach vm->last_update. The CPU path's own waits (amdgpu_vm_cpu_update(), amdgpu_bo_kmap()) use DMA_RESV_USAGE_KERNEL. None of them waits for a clear that is still queued. When one is, the CPU writes the first entries of the new compute VM (the KFD trap handler's TBA/TMA page at AMDGPU_VA_RESERVED_TRAP_START, mapped during ACQUIRE_VM) into a page directory the SDMA then clears. The entries are gone, the handler's page is unmapped, and the first wave save of any queue of the process faults in the SQC instruction fetch at the handler's address (GCVM_L2_PROTECTION_FAULT_STATUS 0x008012B1, PERMISSION_FAULTS 0xb). The MES then fails REMOVE_QUEUE and SUSPEND, and the device takes a MODE1 reset with VRAM lost on 7.2.9; on 7.3-rc6 the queue is reset instead. The window is the time between the render node's open and ACQUIRE_VM. ROCr spends milliseconds there and is practically never hit; a minimal KFD client that opens the render node and acquires the VM at once is hit most of the time. On a Radeon AI PRO R9700 (gfx1201, Resizable BAR, so vm_update_mode defaults to CPU updates for compute VMs), a wave reading the trap handler's page right after queue creation found it unmapped in 8 of 12 runs; a 5 ms sleep between the open and ACQUIRE_VM made that 0 of 9, and the same sleep after queue creation instead 3 of 3. The wait covered these jobs until commit 926c79ad6ecd ("drm/amdgpu: promote the implicit sync to the dependent read fences") narrowed amdgpu_sync_resv() from DMA_RESV_USAGE_BOOKKEEP to DMA_RESV_USAGE_READ; the VM's page table jobs have been added with BOOKKEEP since commit 4247084057cf ("drm/amdgpu: use DMA_RESV_USAGE_BOOKKEEP v2"), so from v6.16 on the sync in amdgpu_vm_make_compute() waits for nothing of them. Record the clears in vm->last_update, as amdgpu_vm_update_pdes() does with its updates, and wait for it, uninterruptibly, before switching the update functions. The clears all go through vm->delayed, so the last one covers the earlier ones; immediate clears are not recorded, as before. With this, on 7.3-rc6 and on 7.2.9, the same client reads the handler 10 of 10 times, 8 busy queues on the 4 compute slots complete in 5 of 5 runs on 7.3-rc6 and 3 of 3 on 7.2.9 (1 of 6 before), 16 and 32 queues complete on 7.3-rc6, and two processes with 8 queues each complete together on both, with no fault. Fixes: 926c79ad6ecd ("drm/amdgpu: promote the implicit sync to the dependent read fences") Cc: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: John Fisher <jfisher84@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 9ec91b35baba45209c3fcd00f086224a158dd512) Cc: stable@vger.kernel.org # v6.16+
12 daysdrm/amdkfd: wait for a GPU reset before freeing a BOWilliam Palacek
When a GPU reset takes the reset domain, KFD eviction cannot unmap user queues: execute_queues_cpsch() fails its trylock with -EIO, so the queues keep running until the ASIC is reset. The TLB flush is also skipped while the reset is in progress. If the process unmaps and frees a BO in that window, its pages are released while a queue can still access them through stale translations. On MI300X, munmap() then crashes in free_swap_cache() on a small bogus page pointer in its mmu_gather batch page: BUG: unable to handle page fault for address: 0000000000002900 RIP: 0010:free_swap_cache+0x5/0xb0 Call Trace: free_pages_and_swap_cache+0x3a/0x60 tlb_batch_pages_flush+0x43/0x80 tlb_flush_mmu+0x3d/0x110 zap_pte_range+0x80d/0xcd0 ... do_vmi_align_munmap+0x3e8/0x5b0 do_vmi_munmap+0xdf/0x190 __vm_munmap+0xad/0x180 __x64_sys_munmap+0x1b/0x30 In a traced crash the bogus pointer was the read pointer value of an SDMA queue the process had just destroyed, at the read pointer's page offset: the queue's writeback landed in its freed rptr page after the page was reused as the batch page. commit f0b4440cdc18 ("drm/amdkfd: Fix mode1 reset crash issue") fixed this race on process exit by waiting for the reset to complete before freeing the process's BOs. Free through the ioctl has the same race. Wait for the reset there too, using the same helper. Fixes: 9c33e5fd4fb6 ("drm/amdgpu: fix locking scope when flushing tlb") Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: William Palacek <William.Palacek@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 06ff8ce77726b15a98fcc285dd6005cb3f48558b) Cc: stable@vger.kernel.org
12 daysdrm/amd/display: Fix swap in median3() for DSC rate controlKeita Morisaki
median3() is meant to return the median of three values, but its last compare-and-swap step swaps b and c instead of a and b. When c is smaller than both a and b, it returns max(a, b) instead of min(a, b). For example, median3(2, 3, 1) returns 3 instead of 2. _do_calc_rc_params() always passes 0 as the first argument, and the second argument is never below 12. So whenever the third argument is negative, first_line_bpg_offset (and second_line_bpg_offset for 4:2:0) is set to the second argument instead of 0. Fix this by swapping a and b in the last step, as intended. Note that this change does not affect valid DSC configurations. The third argument is negative only when bits per pixel exceeds the uncompressed rate of the colour format: - 3 * bpc for 4:4:4, 3 * bpc + 2 for RGB - 2 * bpc for 4:2:2 - 1.5 * bpc for 4:2:0 Fixes: 97bda0322b8a ("drm/amd/display: Add DSC support for Navi (v2)") Signed-off-by: Keita Morisaki <kmta1236@gmail.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1ddc4bc97a62fc89d9d3681413d9f977e1fa1a83) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu/gmc9: add extra type-2 TLB flush for gfx942/gfx950Elena Sakhnovitch
Add extra type-2 TLB flush for GC 9.5.0, similar race condition was observed as Vega20+XGMI. Add to GC 9.4.3 and 9.4.4 too, as they share the same multi-XCD TLB topology. Reported-by: Shahzeb Ahmed <shahzeb.ahmed@amd.com> Reported-by: Manjunath Gaonkar <Manjunath.Gaonkar@amd.com> Signed-off-by: Elena Sakhnovitch <Elena.Sakhnovitch@amd.com> Reviewed-by: Apurv Mishra <apurv.mishra@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 138cfb165ae6aa98c0767b431e718d1a8199db28) Cc: stable@vger.kernel.org
12 daysdrm/amdkfd: fix NULL deref in SDMA HQD debugfs dump on GC 12.1Harish Kasiviswanathan
Reading the KFD HQD debugfs node (dqm_debugfs_hqds) on a gc_12_1_0 part oopses with a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: hqd_sdma_dump_v12_1+0x6a [amdgpu] Call Trace: dqm_debugfs_hqds+0x2da/0x360 [amdgpu] kfd_debugfs_hqds_by_device+0x74/0xa0 [amdgpu] seq_read ... __x64_sys_read get_sdma_rlc_reg_offset() assumes an interleaved layout where the second SDMA per XCC lives in a separate SDMA1_HWIP register aperture. On gc_12_1_0 that aperture does not exist. Rewrite get_sdma_rlc_reg_offset() to mirror sdma_v7_1_get_reg_offset(): base the offset on adev->reg_offset[GC_HWIP][xcc_id][0] and add the per-instance SDMA1 offset for the odd instance. Fixes: 7bd5d763b8e1 ("drm/amdkfd: Add gfx_v12_1_kfd2kgd interface for GFX12_1") Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com> Reviewed-by: Mukul Joshi <mukul.joshi@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 94b2c5b06d37adc0e9a23138252758657b64b58a) Cc: stable@vger.kernel.org
12 daysdrm/amdkfd: don't drop an SVM CWSR reference that was never takenJesse Zhang
When kfd_queue_acquire_buffers() fails, its error path calls kfd_queue_release_buffers(), which also drops a queue_refcount on the SVM range at ctx_save_restore_area_address. The SVM range is the last buffer acquired, and kfd_queue_buffer_svm_get() takes no reference when it fails, so on every error path this reference was never taken. If another queue of the process uses that CWSR range, its reference is dropped instead, and unmapping the range no longer evicts that queue while its CWSR area is unmapped from the GPU. On navi31, with queue A using an SVM CWSR range: munmap() of the range logs Freeing queue vital buffer 0x..., queue evicted but after a CREATE_QUEUE that reuses A's CWSR address with an unmapped write pointer (-EINVAL), the same munmap() leaves A running without the message. Only put the BOs on the acquire error path. The warning and the eviction are back after the failed CREATE_QUEUE. Fixes: b049504e211e ("drm/amdkfd: Validate user queue svm memory residency") Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 9a08122e6361ef73f4b512d5db9596d561305519) Cc: stable@vger.kernel.org
12 daysdrm/amd/display: Adjust HDMI FRL LT timeoutIlya Bakoulin
[Why & How] Extend LT timeout for link rates <16G to avoid intermittent compliance failures. Reviewed-by: Relja Vojvodic <relja.vojvodic@amd.com> Reviewed-by: Chris Park <chris.park@amd.com> Signed-off-by: Ilya Bakoulin <Ilya.Bakoulin@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 378e096423269a466d23a5d5ce65051e8ef1e474)
12 daysdrm/amd/pm: reapply umd profile state after recoveryKevin Wang
Resume and full GPU reset retain the selected UMD profile level in driver state. The GFX and PMFW state behind it is reinitialized. Add a generic DPM reapply path after CG and PG restoration. It restores the UMD GFX state and asks the PM backend to replay the retained level. v2: - Reapply only GFX CG to preserve the profile-owned GFX PG reference. - Fall back to AUTO when reapply fails without failing device recovery. - Propagate PowerPlay DPM errors before accepting AUTO fallback. - Limit workload-profile error reporting to the swSMU reapply path. This covers: - PCI runtime resume - Full GPU reset recovery - System resume, including S3 and s2idle Signed-off-by: Kevin Wang <kevin.wang@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit fd0699fc9f4266fc07d6ce6dbb484fac04601106) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: reject ANONONLY userptrs that span multiple VMAsJesse Zhang
For AMDGPU_GEM_USERPTR_ANONONLY, amdgpu_ttm_tt_get_user_pages() only checks the VMA at the start of the range for a backing file, and amdgpu_hmm_range_get_pages() then faults in the whole range, across any other VMAs. The check used to reject ranges ending beyond the first VMA (vma->vm_end < end), which got lost when the code moved to HMM. An ANONONLY userptr over one page of file-backed memory is rejected with -EPERM, but one over an anonymous page followed by the same file-backed page is accepted. Restore the check and reject ANONONLY userptrs that cross more than one VMA. The second userptr is now rejected too. v2: reject ranges spanning multiple VMAs instead of walking every VMA (Christian) v3: cast num_pages to u64 to avoid an overflow (Christian) Fixes: 6826cb3b92a3 ("drm/amdgpu: support userptr cross VMAs case with HMM") Cc: Christian König <christian.koenig@amd.com> Cc: Philip Yang <Philip.Yang@amd.com> Cc: Felix Kuehling <Felix.Kuehling@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Acked-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 75d753ed4704d5efc72164d9e546b2a282e42ae2) Cc: stable@vger.kernel.org
12 daysdrm/amd/display: don't WARN when removing an unallocated MST payloadMario Limonciello
[Why] On an MST teardown that runs through the reset path (dcn31_reset_hw_ctx_wrap -> link_set_dpms_off -> deallocate_mst_payload), fill_dc_mst_payload_table_from_drm() is asked to remove a payload whose vcpi is not present in link->mst_stream_alloc_table and trips: WARNING: .../amdgpu_dm_helpers.c:275 fill_dc_mst_payload_table_from_drm This is a legitimate case, not an error: deallocate_mst_payload() can be called for a stream whose MST payload was never programmed into DC's HW-maintained table (a new stream created for a modeset whose enable never completed, as already documented in deallocate_mst_payload()). There is simply nothing to remove. [How] Drop the ASSERT and fall through to the fill loop, which rebuilds the allocation table from the remaining entries. The table ends up unchanged, which is correct: the payload being removed was never in it. Note the loop must not early-return here - the caller passes a zeroed proposed_table, so returning early would zero the whole link's table and drop the other MST streams sharing the link. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5875 Reviewed-by: Wayne Lin <wayne.lin@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 88a27f624dc0ebc14a7ab274a84d977ce8513cb6) Cc: stable@vger.kernel.org
12 daysdrm/amd/display: Fix HDMI FRL FFE compliance testIlya Bakoulin
[Why & How] The FFE electrical compliance test behavior is not correct. The driver doesn't properly iterate over the FFE levels and select PS/DE based on test request and/or cable-ID. Fix the initialization of the link state so that when the polling loop takes over, the test proceeds as described in the spec. Reviewed-by: Relja Vojvodic <relja.vojvodic@amd.com> Signed-off-by: Ilya Bakoulin <Ilya.Bakoulin@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1903c3389c81bc65f57f0edeea879359d674bb33)
12 daysdrm/amdkfd: fix doorbell allocation race creating duplicate allocationsHenry Martin
The check-and-allocate sequence on pdd->qpd.proc_doorbells is lockless at every call site of kfd_alloc_process_doorbells(): kfd_get_process_doorbells() (mmap of /dev/kfd), kfd_ioctl_create_queue() and the CRIU restore path each test the pointer under different locking (or none), so two racing threads can both observe NULL and each allocate a doorbell BO and bitmap, orphaning one allocation and handing the two mappings different backing pages. Move the serialization into kfd_alloc_process_doorbells() itself, using a new per-process-device mutex so all three call sites are covered regardless of their own locking. The device-global kfd->doorbell_mutex is not suitable here: it is acquired under dqm->lock on the kernel-doorbell path (start_cpsch() -> pm_init() -> kq_initialize() -> kfd_get_kernel_doorbell()), so holding it across the sleeping allocations above would create a lock-ordering inversion with dqm->lock via TTM eviction, and it would also serialize doorbell setup of unrelated processes behind a device-wide lock for per-process state. This issue was discovered by Tencent CodeBuddy Security. v3 (Felix Kuehling): - Removed unlocked check in kfd_get_process_doorbell flagged as problematic by Sashiko Bot. Fall back to the locked check inside kfd_alloc_process_doorbells - Added missing mutex_destroy v4 (Felix Kuehling): - Removed unlocked checks around other kfd_alloc_process_doorbells calls Fixes: 16f0013157bf ("drm/amdkfd: Allocate doorbells only when needed") Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com> Signed-off-by: Felix Kuehling <felix.kuehling@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 4e27ba5ad5f76932d4f6cbacd25c81c2dd40ec4a) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: reset VI ASIC on Apple boards with VRAM at 0Maciej Kucharek
On MacBookPros with switchable graphics, the firmware puts VRAM at MC address 0 when the iGPU is enabled. A later post (S3 resume, GPU reset) moves VRAM back to the VBIOS default. gmc_v8_0 reads MC_VM_FB_LOCATION once at init and reprograms it only on SR-IOV. On bare metal, the driver then keeps using the old layout. vi_reset_quirks[] handles this for the MacBookPro14,3 by PCI ID: commit b6b1d9721851 ("drm/amdgpu: reset VI ASIC on MacBookPro14,3") Add the test that SI and CIK use: an Apple subsystem vendor and VRAM at 0. Other Polaris MacBookPros then get the same reset at load, for example the MacBookPro13,3 if its firmware leaves VRAM at 0. These boards are not tested. Keep vi_reset_quirks[]. Its MacBookPro15,1 entries fix a different failure, a module reload after S3: commit a5be7ad8f5f0 ("drm/amdgpu: reset VI ASIC on MacBookPro15,1") VRAM is not at 0 at that point, so the new test may not cover it. After the reset, FB_BASE is not 0, so the new test does not fire again on a module reload. Only compile-tested. Suggested-by: Alex Deucher <alexander.deucher@amd.com> Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Maciej Kucharek <qchcio@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit c2335b685b1e1e387f2fea1c67f56b5b8a8b6dc6) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: reset CIK ASIC on Apple boards with VRAM at 0Maciej Kucharek
On MacBookPros with switchable graphics, the firmware puts VRAM at MC address 0 when the iGPU is enabled. A later post (S3 resume, GPU reset) moves VRAM back to the VBIOS default. The SI fix resets and posts the ASIC at load, so the driver uses the VBIOS layout from the start: "drm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0" No MacBookPro has a CIK GPU, and no affected CIK board is known. Add the same test to cik_need_reset_on_init(), so that SI, CIK and VI handle this firmware layout in the same way. gmc_v7_0 reads MC_VM_FB_LOCATION once at init and does not reprogram it. A CIK board with VRAM at 0 therefore has the same problem as the SI boards. After the reset, FB_BASE is not 0, so the new test does not fire again on a module reload. Only compile-tested. Suggested-by: Alex Deucher <alexander.deucher@amd.com> Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Maciej Kucharek <qchcio@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 6bb4b79d6a6c461b40750fd67cb4e2a070e20b67) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: reset SI ASIC on MacBookPros with VRAM at 0Maciej Kucharek
On MacBookPros with switchable graphics, the firmware puts VRAM at MC address 0 when the iGPU is enabled. The EFI stub enables the iGPU on these machines through apple_set_os(). On a MacBookPro11,5 (Radeon R9 M370X, 1002:6821, subsystem 106b:0149), the driver adopts this layout at init: MC_VM_FB_LOCATION=0x007f0000, HDP_NONSURFACE_BASE=0 VRAM at 0x0-0x7fffffff, GART table at 0x1400000 The driver posts the ASIC again on S3 resume and after a GPU reset. The VBIOS asic_init table then moves VRAM back to the VBIOS default: MC_VM_FB_LOCATION=0xf47ff400, HDP_NONSURFACE_BASE=0xf4000000 gmc_v6_0 does not reprogram these registers. The GART table is then no longer in VRAM, and the gfx ring test times out: amdgpu: ring gfx test failed (-110) amdgpu: resume of IP block <gfx_v6_0> failed -110 Reset and post the ASIC at driver load on Apple boards with VRAM at 0. The driver then uses the VBIOS layout (VRAM at 0xf400000000) from the start, and later posts keep it. After the reset, FB_BASE is not 0, so a module reload does not reset the ASIC again. The test is the same one that commit c54e4d105077 ("drm/amdgpu: make Mac FB workaround generic") uses: an Apple subsystem vendor and VRAM at 0. The VI quirk for the MacBookPro14,3 resets at load for the same reason: commit b6b1d9721851 ("drm/amdgpu: reset VI ASIC on MacBookPro14,3") Other Apple SI boards get the same reset if FB_BASE reads 0 at load. Tested on a MacBookPro11,5 with 7.2.5 and this patch: the panel comes up at boot, and 4 of 4 deep S3 cycles resume. Without the patch, S3 resume fails every time. The GPU reset path is not tested. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5978 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Maciej Kucharek <qchcio@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 60dd16ae10f286cb9cce5b6027b2d5ee869637af) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: require _PR3 for BOCOLuigi Lauro
amdgpu_device_supports_boco() returns true for an AMD_IS_PX device on a system with a hybrid ATPX method even when the device has no ACPI power resource (_PR3). On an APU mini PC with a discrete GPU attached over OCuLink, the iGPU's ATPX method reports hybrid graphics, the dGPU is flagged AMD_IS_PX, and runtime PM in auto mode picks BOCO: amdgpu: ATPX Hybrid Graphics amdgpu 0000:c6:00.0: Using BOCO for runtime pm In BOCO mode the driver leaves powering the device off to the PCI core, which can only do it through _PR3 on the upstream bridge. No device on this dGPU's path has _PR3, so when it runtime suspends the card stays powered, with its fans at about 700 rpm. Require has_pr3 for BOCO, as the function's description ("dGPU with ACPI power resources") says. The same card then picks BACO, which powers it down: amdgpu 0000:c6:00.0: Using BACO for runtime pm This only changes systems with a hybrid ATPX method and no _PR3 on the dGPU's upstream bridge, where BOCO cannot cut the power today. Tested on one such system only, an RX 9070 XT (Navi 48) over OCuLink with a Ryzen AI 9 HX 470, with the change backported to 7.2.9: the stock module logs "Using BOCO", the patched one "Using BACO"; BACO runtime suspend powers the card off and it resumes cleanly. Not tested on a hybrid laptop or a Thunderbolt eGPU. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5980 Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Luigi Lauro <luigi.lauro@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 1a039805354a44aab7abb2a6e685212d48b17a5e) Cc: stable@vger.kernel.org
12 daysMerge branches 'apple/dart', 'arm/smmu/updates', 'arm/smmu/bindings', ↵Joerg Roedel
'hyper-v', 'samsung/exynos', 'riscv', 'broadcom', 'intel/vt-d', 'amd/amd-vi' and 'core' into next
2026-10-16drm/amdgpu: fix the error path in amdgpu_vm_pt_alloc()Jesse Zhang
amdgpu_vm_pt_alloc() drops the eviction lock while it creates the new page table. When the VM started to get evicted in the meantime, amdgpu_vm_begin_critical() returns -EBUSY and we jump to error_free_pt before pt_bo is assigned. That unreferences an uninitialized pointer, leaks the new page table (still pinned for NPA VMs) and returns 0 since r is the result of the successful page table creation. With vm->evicting set right after amdgpu_vm_pt_create() (what amdgpu_vm_evictable() does when TTM evicts one of the VM page tables in that window), the first GEM_VA map that needs a new page table oopses: BUG: kernel NULL pointer dereference, address: 0000000000000460 RIP: 0010:amdgpu_bo_unref+0x27/0x70 [amdgpu] Call Trace: amdgpu_vm_ptes_update+0xa4e/0xa60 [amdgpu] amdgpu_vm_update_range+0x2eb/0x970 [amdgpu] amdgpu_vm_bo_update+0x325/0x6d0 [amdgpu] amdgpu_gem_va_update_vm+0xdb/0x1c0 [amdgpu] amdgpu_gem_va_ioctl+0x86c/0x940 [amdgpu] Assign pt_bo first, unpin and free the new page table and return the error from amdgpu_vm_begin_critical(). Fixes: 0dc93a683a94 ("drm/amdgpu: rework eviction lock handling into critical section v3") Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 26b68a5702421d0a235ca5894e3797fc9cdc1ec2)
2026-10-16drm/amdgpu: wake the GPU for INFO queries that access the hardwareJesse Zhang
Since amdgpu_drm_ioctl() was removed, amdgpu_info_ioctl() no longer holds a runtime PM reference. When the GPU is runtime suspended, the queries that touch the hardware run against a powered down device: - AMDGPU_INFO_READ_MMR_REG reads all ones, - AMDGPU_INFO_TIMESTAMP returns ~0ull, - AMDGPU_INFO_DEV_INFO reports 0 for the engine and memory clock limits because the SMU is down, - AMDGPU_INFO_SENSOR fails with -ENOENT. On gfx11 with an idle GPU in BAMACO, GRBM_STATUS reads 0xffffffff instead of 0x0000302c, the timestamp is 0xffffffffffffffff, and the min/max sclk is reported as 0/0 kHz instead of 500000/1880000 kHz. Resume the GPU for these queries, the same way the CS ioctl does. Fixes: 3d3140b5b0d0 ("drm/amdgpu: get rid of amdgpu_drm_ioctl") Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 5ee0ab19c2c0e0c863a5b7595b263ef6f3886c24)
2026-10-16drm/amdgpu: Enable remote TLB shootdownPhilip Yang
FW remote TLB shootdown support is ready now. Remove the early-return stub so the command is actually sent to the peer GPU. This requires nHT firmware version >= 1.2.E.1 (IFWI >= BRP0660). Signed-off-by: Philip Yang <Philip.Yang@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f1be774d6d0128346fea1dc616fdf623c898c82c)
2026-10-16drm/amdgpu: Reject UALink source-identification address modePhilip Yang
Source-identification address mode has never been tested or enabled, so reject it in __check_vpod_info() instead of running with an untested config. Both the inband and the sideband vpod config paths go through this validation. The SOURCE_IDENT handling in the rest of the driver is left in place for when the mode is enabled. Also drop r from the vpod-commit error message, __check_vpod_info() returns bool, so r is uninitialized there. v2: use switch to check address mode. Signed-off-by: Philip Yang <Philip.Yang@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit a925a168ba7e8afc06884058dfdd0cf0dc8995ca)
2026-10-16drm/amdkfd: Fix svm_bo use after free in svm_range_clonePhilip Yang
prange->svm_bo stays set after the range drops its reference in svm_range_vram_node_free(), it is only cleared later by svm_range_bo_release(). Taking a new reference based on old->svm_bo can therefore hit a svm_bo with refcount 0 and svm_range_bo_release_async() pending, leaving the clone with a freed svm_bo. Use svm_bo_ref_unless_zero() under old->lock to only share the svm_bo if it is still alive, same as svm_range_validate_svm_bo() does. A range only holds a svm_bo reference while ttm_res is set, so drop the reference again if old had already dropped its own. The clone keeps the svm_bo pointer and stays on svm_bo->range_list, so svm_range_bo_release() clears the pointer when the svm_bo goes away. The unref must be done outside old->lock because svm_range_bo_release() takes the lock of every range on the list, including old. v3: drop the reference if ttm_res is not set, don't leak it. v2: use svm_bo_ref_unless_zero instead of checking old->ttm_res, to keep sharing the svm_bo when the range dropped its own reference (Felix). Signed-off-by: Philip Yang <Philip.Yang@amd.com> Signed-off-by: Mukul Joshi <mukul.joshi@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 0f862d8774161af543fdf6bbc279ba9182c3f8de)
generated by cgit v1.2.3 (git 2.0.4) at 2026-11-01 15:36:34 +0000