summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-07-28drm/amd/display: Test CRTC color management updateAlex Hung
[WHAT] Add KUnit coverage for amdgpu_dm_check_crtc_color_mgmt() and amdgpu_dm_update_crtc_color_mgmt(). A shared color-update fixture (adev/DC, atomic state, CRTC/stream and plane state) backs the tests: the check path succeeds with no CRTC LUTs, and the update path leaves the stream gamut remap bypassed without a CTM and enables it when a CRTC CTM is present. Assisted-by: Copilot:Claude-Opus-4.8 GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Test plane colorop helper walkersAlex Hung
[WHAT] Add KUnit coverage for the per-colorop plane helpers __set_dm_plane_colorop_multiplier(), __set_dm_plane_colorop_3x4_matrix() and __set_dm_plane_colorop_degamma(). A single-colorop atomic-state fixture drives each helper: the multiplier programs hdr_mult, the 3x4 matrix enables gamut remap (and rejects a wrong blob length), and the degamma 1D curve maps to a predefined transfer function (and rejects an unsupported curve). Assisted-by: Copilot:Claude-Opus-4.8 GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Test color mod init and 3D LUT sizeAlex Hung
[WHAT] Add KUnit coverage for amdgpu_dm_init_color_mod() and amdgpu_dm_verify_lut3d_size(). init_color_mod is a smoke test that the x-points distribution is set up without crashing. The verify_lut3d_size tests build adev/DC fixtures with and without the 3D LUT capability and confirm that correct shaper and 3D LUT blob sizes succeed while mismatched sizes return -EINVAL. Assisted-by: Copilot:Claude-Opus-4.8 GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Split DPMS ON into partsDominik Kaszewski
[Why] Ongoing optimization efforts require splitting DPMS ON around enable_link, in order to enable running multiple sequences in parallel. [How] * Split link_set_dpms_on across enable_link * Add return value indicating whether the programming sequence succeeded and/or run to the end. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Dominik Kaszewski <dominik.kaszewski@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Add DWB validation support to DML2.1 wrapperDillon Varone
[WHY&HOW] DML2.1 wrapper was lacking translation for DWB. This change adds the necessary translation for DWB validation and programming support. Reviewed-by: Austin Zheng <austin.zheng@amd.com> Signed-off-by: Dillon Varone <Dillon.Varone@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: fix debug flags assignment in dmub_replay.cRobin Chen
[WHY] Fix incorrect casting of debug flags to uint16_t, which could truncate the value. Reviewed-by: ChunTao Tso <chuntao.tso@amd.com> Signed-off-by: Robin Chen <robin.chen@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Add EDID management tests for connectorBhawanpreet Lakha
Add KUnit coverage for hdmi_cec_unset_edid(), create_eml_sink() and handle_edid_mgmt(): unset edid with no notifier, eml sink with no edid, and DP vs non-DP edid management link caps handling. Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Add encoder helper tests for connectorBhawanpreet Lakha
Add KUnit coverage for the encoder helpers dm_encoder_helper_disable() and dm_encoder_helper_atomic_check(): disable no-op, eDP native keeps scaling, LVDS non-native enables scaling, and the non-MST zero return. Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Add destroy tests for connectorBhawanpreet Lakha
Add KUnit coverage for amdgpu_dm_connector_destroy(): minimal teardown plus releasing the dc_sink and dc_em_sink references. Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Add register and unregister tests for connectorBhawanpreet Lakha
Add KUnit coverage for amdgpu_dm_connector_late_register() and amdgpu_dm_connector_unregister(): non-DP late register succeeds and non-DP unregister is a no-op. Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Add detect and poll tests for connectorBhawanpreet Lakha
Add KUnit coverage for amdgpu_dm_connector_detect() and amdgpu_dm_connector_poll(): force on (analog/digital), force off, sink present/absent, and the DAC-load cached status path. Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Add stream creation tests for connectorBhawanpreet Lakha
Add KUnit coverage for create_stream_for_sink(): fake sink success, dm context setup, virtual signal handling, scaling source, and reuse of an existing sink. Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Replace amdgpu_dm_kunit_helpers.h with dm_helpers.hBhawanpreet Lakha
Drop the amdgpu_dm_kunit_helpers.h include across the amdgpu_dm source files and use dm_helpers.h instead Assisted-by: Copilot:Claude-Opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Add updated MCIF ARB register definitionsDillon Varone
[WHY&HOW] DCN4+ use a new structure for MCIF arbiter registers. Reviewed-by: Austin Zheng <austin.zheng@amd.com> Signed-off-by: Dillon Varone <Dillon.Varone@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Fix DP LT failure loggingIlya Bakoulin
[Why/How] The final DP LT failure meant to be logged as DC warning is skipped due to a break statement above. Move logging up to make sure we don't miss LT fail events. Reviewed-by: George Shen <george.shen@amd.com> Signed-off-by: Ilya Bakoulin <Ilya.Bakoulin@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Refactor DPP_SET_OUTPUT_TRANSFER_FUNC to drop pipe_ctxTomasz Siemek
[why] Pipe_ctx shouldn't be passed as block sequence block parameter. [how] Adjust arguments for set_output_transfer_func and implementations. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Tomasz Siemek <tomasz.siemek@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Refactor DPP_PROGRAM_GAMUT_REMAP to drop pipe_ctx paramTomasz Siemek
[why] Pipe_ctx shouldn't be passed as block sequence block parameter. [how] - Adjust program_gamut_remap_params struct. - Adjust program_gamut_remap interface and implementations. - Adjust program_gamut_remap callsites to match new signature. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Tomasz Siemek <tomasz.siemek@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Drop CONFIG_DRM_AMD_DC_DCN4_2 from 3dlut codeTomasz Siemek
[why] CONFIG_DRM_AMD_DC_DCN4_2 were readded to DAL by mistake resulting in parts of dcn42 3dlut code not being compiled. [how] Remove readded CONFIG_DRM_AMD_DC_DCN4_2 guards. Reviewed-by: Rafal Ostrowski <rafal.ostrowski@amd.com> Signed-off-by: Tomasz Siemek <tomasz.siemek@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: add VBIOS bounding box KUnit testAlex Hung
[WHAT] Add a KUnit test for dm_dmub_get_vbios_bounding_box() covering the default IP-version path that returns NULL without allocating GPU memory or issuing GPINT commands. Assisted-by: Copilot:Claude-Opus-4.8 GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: add DMUB command sync KUnit coverageAlex Hung
[WHAT] Add KUnit coverage for the synchronous DMUB command helpers: dm_execute_dmub_cmd(), amdgpu_dm_process_dmub_aux_transfer_sync(), and amdgpu_dm_process_dmub_set_config_sync(). Cover command submission without a DC DMUB service, AUX engine-acquire failure, protocol-error propagation, the bounded reply-data copy, the zero-length reply branch, and the SET_CONFIG completed-with-unknown-error path. Assisted-by: Copilot:Claude-Opus-4.8 GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: add fused IO KUnit coverageAlex Hung
[WHAT] Add KUnit coverage for the DMUB fused IO helpers: the dm_dmub_aux_fused_io_callback() NULL-argument guard and the abort_fused_io() no-DMUB-service path. Assisted-by: Copilot:Claude-Opus-4.8 GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: add dm_dmub_hw_resume KUnit coverageAlex Hung
[WHAT] Extend KUnit coverage for dm_dmub_hw_resume() using the fake-DMUB fixtures. New cases cover the already-initialized wait path, the full reinitialization path, a failed init-state query, and an auto-load timeout, none of which require real hardware. Assisted-by: Copilot:Claude-Opus-4.8 GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: add dm_dmub_hw_init KUnit coverageAlex Hung
[WHAT] Add KUnit coverage for dm_dmub_hw_init() beyond the existing early-return cases. Introduce reusable fake-DMUB fixtures (fake dmub_srv/firmware, DMCU/ABM stubs, and adev builders) so the init path runs without real register access, TTM allocation, or firmware loading. New cases cover the fake-DMUB success path, unsupported hardware, BSS data copy, hardware-init failure, auto-load timeout, the APU/DPIA DCN3.5 params, the DCN3.1.x sanity-check ranges, and DMCU/ABM initialization. Assisted-by: Copilot:Claude-Opus-4.8 GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Wayne Lin <wayne.lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Increase HDMI AV mute wait from 2 to 3 framesRay Wu
Some HDMI sinks need additional GCP packets to properly process the mute state before the timing generator is disabled, especially after link re-establishment with HDMI 2.0 scrambling enabled. Waiting for only 2 frames is insufficient for certain monitor firmware, resulting in garbled display output on resume from suspend. Increase the AV mute wait in dcn30_set_avmute() from 2 to 3 frames to ensure the sink receives enough GCP packets. Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5167 Assisted-by: Cursor:Claude-Opus-4.6 Reviewed-by: Wayne Lin <wayne.lin@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Add MCIF ARB programming structuresDillon Varone
[WHY&HOW] Adds required structures to configure MCIF ARB for DWB. Signed-off-by: Dillon Varone <Dillon.Varone@amd.com> Reviewed-by: Wayne Lin <Wayne.Lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Add Writeback Watermarks and Latency FieldsAustin Zheng
Add fields that can used for writeback watermarks and latency margin Signed-off-by: Austin Zheng <Austin.Zheng@amd.com> Reviewed-by: Wayne Lin <Wayne.Lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: Correct pipe usage for populating stream configDillon Varone
[WHY&HOW] Was incorrectly using stream index to index pipes, when should have been using callback to get otg master pipe for stream. Acked-by: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Dillon Varone <Dillon.Varone@amd.com> Signed-off-by: Wayne Lin <Wayne.Lin@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amdgpu: Resolve VM through DRM PASID ownershipSrinivasan Shanmugam
Allocate DRM PASIDs with fpriv and resolve VM lookup users through: PASID -> fpriv -> VM This preserves the root BO reference and revalidation flow in amdgpu_vm_lock_by_pasid(). The obsolete per-device vm_manager.pasids mapping is removed by the following patch in this series. v6: - Allocate and publish the DRM PASID after amdgpu_vm_init() completes. - Assign the allocated PASID to vm->pasid in the DRM open path. - Unpublish PASID ownership before tearing down the VM in both the open-failure and normal file-close paths. v5: - Delay DRM PASID allocation until after amdgpu_vm_init() completes. v4: - Allocate DRM PASIDs with fpriv directly. - Squash ownership registration and PASID lookup conversion. Cc: Alex Deucher <alexander.deucher@amd.com> Suggested-by: Christian König <christian.koenig@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amdgpu: Allow PASID allocator to store fpriv ownerSrinivasan Shanmugam
AMDGPU already has a global PASID xarray used for PASID allocation. Allow amdgpu_pasid_alloc() to optionally store the owning DRM file-private object directly. Initial callers pass NULL. A later patch in this series passes the DRM file-private object for DRM PASIDs. This prepares for using: PASID -> fpriv -> VM instead of: PASID -> VM Clear the stored owner from amdgpu_pasid_free_delayed() before waiting for outstanding fences so PASID lookups cannot observe a stale fpriv while the PASID itself is pending delayed release. v6: - Correct the PASID allocator kernel-doc to refer to the XArray cyclic allocator. - Document that PASID owner lookup may return NULL and that the returned fpriv remains valid only while the PASID lock is held. - No code changes. Retain Christian's Reviewed-by tag. v5: - Store NULL instead of xa_mk_value(0) for ownerless PASIDs. - Simplify owner clearing by unconditionally storing NULL. v4: - Add fpriv as an optional parameter to amdgpu_pasid_alloc(). - Drop separate amdgpu_pasid_set_fpriv()/clear_fpriv() helpers. - Clear PASID owner from amdgpu_pasid_free_delayed(). Cc: Alex Deucher <alexander.deucher@amd.com> Suggested-by: Christian König <christian.koenig@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amdgpu/ras: Add debug mask to disable CE logs for unirasCe Sun
Add debug mask to disable kernel logs of RAS correctable errors, including both ACA and CE error counter kernel messages. Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amdgpu/imu11: WARN() rather than BUG()Alex Deucher
There's no need to crash the kernel for this case. Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amd/display: add dcn42b specific SMU clock table readGabe Teeger
[Why] On DCN42B the SMU reports its DpmClocks table in a different layout than DCN42, with extra clock domains. The clk_mgr was parsing it with the DCN42 layout. [How] Add a DCN42B DpmClocks struct and a dcn42b_get_smu_clocks() that allocates and parses the DCN42B layout, reusing the shared dcn42 helpers so DCN42 is untouched. Populate DCF, SOC, DISP, DPP and FCLK levels and the memory pstate table. Reviewed-by: Charlene Liu <charlene.liu@amd.com> Signed-off-by: Gabe Teeger <gabe.teeger@amd.com> Signed-off-by: Matthew Stewart <matthew.stewart2@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/amdgpu: skip clearing empty freed VM list on GEM closeBob Zhou
amdgpu_vm_clear_freed() allocates an amdgpu_sync object and walks the VM reservation fences via amdgpu_sync_resv() before checking whether vm->freed has anything to clear. Return early when the list is empty to skip this overhead on a hot path (every GEM close and command submission). Signed-off-by: Bob Zhou <bobzhou2@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-07-28drm/vc4: Zero the tile state data array before each BIN jobMaíra Canal
The binner BO is a single 16MB buffer split into 512KB slots that are handed out to jobs at submission time and recycled as jobs complete, without ever being cleared. Each slot holds the job's Tile State Data Array (TSDA) at its start, followed by the tile allocation pool. While the tile allocation pool is only walked by the render thread through branches the binner generated during the current job, the TSDA is the PTB's own per-tile bookkeeping and is consumed by the hardware itself. Although the kernel sets the "Auto-initialise Tile State Data Array" flag in the tile binning mode configuration, the PTB demonstrably still acts on stale tile state left by the slot's previous user: the binner ends up creating invalid command streams with invalid primitive streams and branches, which can cause GPU hangs as observed in [1][2]. Zero the TSDA when the job's binning slot is configured. This clears 48 bytes per tile (~24KB for a 1080p frame) in the submission path, and guarantees the PTB never sees another job's tile state. The tile count is only checked for being non-zero today, so the 8-bit fields it comes from can describe a tile state array almost six times larger than the slot it has to live in. Bound it before the slot is handed out, since such size decides how much of the slot is left for the tile alloc pool. Link: https://github.com/raspberrypi/linux/issues/3221 [1] Link: https://github.com/raspberrypi/linux/issues/5780 [2] Fixes: 553c942f8b2c ("drm/vc4: Allow using more than 256MB of CMA memory.") Cc: stable@vger.kernel.org Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260727-vc4-bin-oom-fixes-v2-2-0d8a5eddc7c9@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-07-28drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO sizeJose Maria Casanova Crespo
vc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB binner BO, but writes the size of the whole BO to BPOS. On every binner out-of-memory event the PTB is therefore authorized to write tile lists across all the other slots (which may hold the tile state, tile alloc and overflow memory of in-flight jobs) and, for any slot but the first, past the end of the binner BO into unrelated CMA memory. Since CMA pages are recycled into page cache and user allocations, this is arbitrary memory corruption by GPU DMA. In practice it shows up as GPU hangs with corrupted control list pointers, userspace heap corruption, a GPU that stays permanently wedged after the first hang, and occasional full system crashes, whenever a job overflows the initial binner slot. The bug dates back to the conversion from a dedicated overflow BO (where writing the full BO size was correct) to the slotted binner BO. Fixes: 553c942f8b2c ("drm/vc4: Allow using more than 256MB of CMA memory.") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.8 Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com> Reviewed-by: Maíra Canal <mcanal@igalia.com> Reviewed-by: Iago Toral Quiroga <itoral@igalia.com> Link: https://patch.msgid.link/20260727-vc4-bin-oom-fixes-v2-1-0d8a5eddc7c9@igalia.com Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-07-28Merge remote-tracking branch 'drm/drm-next' into drm-rust-nextDanilo Krummrich
Backmerge to pull in commit 21fcb222f0d1 ("drm: Remove DRIVER_GEM_GPUVA feature flag"), which a Tyr patch series depends on. Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-07-28drm/xe/pt: check no-DMA huge-pte cases before DMA segment testHimal Prasad Ghimiray
On a non-range clear, curs.size is never set, so the segment test (next - va_curs_start > curs->size) returns false for every level > 0 before the clear_pt short-circuit is reached. The clear then descends to level 0 instead of forming a huge zero-leaf, wasting page tables and risking -ENOMEM on unbind. Move the null-VMA, purged-BO and clear_pt short-circuits above the curs->size test. The bind path always sets curs.size, so it is unaffected. v2 - Also set curs.size on the clear path so the cursor stays meaningful during the walk. clear_pt is only reached with range == NULL, so assert that invariant. (Matthew Brost) Cc: Matthew Brost <matthew.brost@intel.com> Fixes: 5b658b7e89c3 ("drm/xe: Clear scratch page on vm_bind") Reported-by: Sashiko <sashiko-bot@kernel.org> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260728055916.593707-2-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
2026-07-28gpu: nova-core: fix packed registry table sizeAlexandre Courbot
`PACKED_REGISTRY_TABLE::size` describes the entire table, including its fixed-size header. `SetRegistry` currently initializes it with only the variable payload length, omitting the 8 bytes header. Fix this by using `CommandToGsp::size` to obtain the actual command size, including its header. Fixes: 19b0a6e7c2be ("gpu: nova-core: gsp: Add SetRegistry command") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/r/20260722075253.B6DDB1F00A3D@smtp.kernel.org Reviewed-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260723-nova-registry-size-fix-v1-1-8f471ba00ab4@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-07-27Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixesMaarten Lankhorst
Backmerge v6.2-rc5 to pick up merged fixes.
2026-07-27drm/nouveau/kms/nv50-: Unconditionally create blend_mode prop for wndwsLyude Paul
Since the commit mentioned down below, it looks like we've been triggering this WARN_ON(): [ 31.477009] ------------[ cut here ]------------ [ 31.477012] [PLANE:66:curs-0] pixel format with alpha exposed but blend mode not setup [ 31.477014] WARNING: drivers/gpu/drm/drm_mode_config.c:872 at drm_mode_config_validate+0x38c/0x4c0, CPU#1: modprobe/1264 [ 31.477125] CPU: 1 UID: 0 PID: 1264 Comm: modprobe Not tainted 7.2.0-rc2Lyude-Test+ #1 PREEMPT(lazy) [ 31.477129] Hardware name: Micro-Star International Co., Ltd. MS-7A39/A320M GAMING PRO (MS-7A39), BIOS 1.M4 05/10/2023 [ 31.477132] RIP: 0010:drm_mode_config_validate+0x394/0x4c0 [ 31.477136] Code: 41 3b 9e 80 00 00 00 73 bd 49 8b 46 78 8b 3c 98 e8 c1 3d ff ff 80 78 14 00 74 e1 48 8d 3d 64 e6 e7 01 49 8b 56 18 41 8b 76 50 <67> 48 0f b9 3a 49 8b 46 08 4c 8d 70 f8 49 39 c5 75 97 8b 95 b8 02 [ 31.477139] RSP: 0018:ffffd48e053bb7f8 EFLAGS: 00010202 [ 31.477143] RAX: ffffffffaf1da9c0 RBX: 0000000000000000 RCX: 0000000000000034 [ 31.477145] RDX: ffff8cd883c1feb0 RSI: 0000000000000042 RDI: ffffffffb069f840 [ 31.477148] RBP: ffff8cd88ea3d800 R08: 0000000034325241 R09: ffff8cd88ea3dac0 [ 31.477150] R10: fffffaf5c4043600 R11: ffff8cd88004f600 R12: 0000000000000001 [ 31.477152] R13: ffff8cd88ea3da90 R14: ffff8cd88b9ec038 R15: ffff8cd88ea3dab0 [ 31.477154] FS: 00007fb934898780(0000) GS:ffff8cd9f3a6a000(0000) knlGS:0000000000000000 [ 31.477157] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 31.477160] CR2: 0000555efff79520 CR3: 0000000122cd5000 CR4: 00000000003506f0 [ 31.477162] Call Trace: [ 31.477165] <TASK> [ 31.477168] ? nouveau_hwmon_init+0x2d6/0x330 [nouveau] [ 31.477346] drm_dev_register+0x19d/0x270 [ 31.477352] nouveau_drm_device_init+0x17a/0x230 [nouveau] [ 31.477523] nouveau_drm_probe+0x13d/0x1e0 [nouveau] [ 31.477690] local_pci_probe+0x3e/0x90 [ 31.477697] pci_call_probe+0x59/0x190 [ 31.477702] ? srso_return_thunk+0x5/0x5f [ 31.477706] ? pci_match_device+0x15a/0x180 [ 31.477710] ? pci_assign_irq+0x2d/0x160 [ 31.477714] pci_device_probe+0x95/0x160 [ 31.477719] call_driver_probe+0x26/0x100 [ 31.477724] ? driver_sysfs_add+0x59/0xd0 [ 31.477738] really_probe+0xcc/0x2c0 [ 31.477743] ? srso_return_thunk+0x5/0x5f [ 31.477749] __driver_probe_device+0x85/0x170 [ 31.477754] driver_probe_device+0x1f/0x90 [ 31.477760] ? __pfx___driver_attach+0x10/0x10 [ 31.477766] __driver_attach+0xcb/0x210 [ 31.477772] bus_for_each_dev+0x85/0xd0 [ 31.477779] bus_add_driver+0x13e/0x220 [ 31.477786] ? __pfx_init_module+0x10/0x10 [nouveau] [ 31.477979] driver_register+0x75/0xe0 [ 31.477984] ? srso_return_thunk+0x5/0x5f [ 31.477990] nouveau_drm_init+0x8b/0xff0 [nouveau] [ 31.478192] do_one_initcall+0x5d/0x300 [ 31.478204] do_init_module+0x86/0x290 [ 31.478212] init_module_from_file+0xd8/0x140 [ 31.478223] idempotent_init_module+0x114/0x310 [ 31.478233] __x64_sys_finit_module+0x71/0xe0 [ 31.478238] do_syscall_64+0xe2/0x630 [ 31.478252] ? srso_return_thunk+0x5/0x5f [ 31.478257] ? vfs_read+0x165/0x390 [ 31.478267] ? srso_return_thunk+0x5/0x5f [ 31.478271] ? srso_return_thunk+0x5/0x5f [ 31.478276] ? switch_fpu_return+0x52/0xe0 [ 31.478282] ? srso_return_thunk+0x5/0x5f [ 31.478286] ? arch_exit_to_user_mode_prepare.isra.0+0x7e/0x90 [ 31.478292] ? srso_return_thunk+0x5/0x5f [ 31.478296] ? do_syscall_64+0x11f/0x630 [ 31.478301] ? srso_return_thunk+0x5/0x5f [ 31.478305] ? arch_exit_to_user_mode_prepare.isra.0+0x7e/0x90 [ 31.478310] ? srso_return_thunk+0x5/0x5f [ 31.478314] ? do_syscall_64+0x11f/0x630 [ 31.478320] ? srso_return_thunk+0x5/0x5f [ 31.478324] ? arch_exit_to_user_mode_prepare.isra.0+0x7e/0x90 [ 31.478329] ? srso_return_thunk+0x5/0x5f [ 31.478334] ? srso_return_thunk+0x5/0x5f [ 31.478338] ? do_syscall_64+0x99/0x630 [ 31.478343] ? exc_page_fault+0x82/0x1c0 [ 31.478350] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 31.478355] RIP: 0033:0x7fb93410030d [ 31.478372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c3 5a 0f 00 f7 d8 64 89 01 48 [ 31.478375] RSP: 002b:00007ffc587ce738 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 31.478381] RAX: ffffffffffffffda RBX: 0000562f5fb3da60 RCX: 00007fb93410030d [ 31.478385] RDX: 0000000000000000 RSI: 0000562f5fb40590 RDI: 000000000000000d [ 31.478388] RBP: 00007ffc587ce7d0 R08: 0000000000000000 R09: 0000000000000000 [ 31.478391] R10: 0000000000000000 R11: 0000000000000246 R12: 0000562f5fb40590 [ 31.478394] R13: 0000000000040000 R14: 0000562f5fb3db80 R15: 0000000000000009 [ 31.478404] </TASK> [ 31.478407] ---[ end trace 0000000000000000 ]--- Fix it by making sure we unconditionally call drm_plane_create_blend_mode_property for all types of wndws, including those (such as cursors) without a blend_set function. Fixes: 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed") Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20260720215058.398210-4-lyude@redhat.com
2026-07-27drm/nouveau/kms/nv50-: Introduce nv50_wndw_default_state()Lyude Paul
While we don't currently read-in the hardware state of planes, now that we're about to start exposing blend properties for all planes that can support alpha channels: We need to make sure that the initial atomic state for a wndw always starts off with a supported value in pixel_blend_mode. The easiest way to do this is to introduce a nv50_wndw_default_state() function, and use it in nv50_display_read_hw_state() - and use that function to enforce a valid value for pixel_blend_mode during driver startup. Signed-off-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Fixes: 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed") Link: https://patch.msgid.link/20260720215058.398210-3-lyude@redhat.com
2026-07-27drm/nouveau/kms/nv50-: Add .blend_modes to nv50_wndw_funcLyude Paul
At the moment, we currently (incorrectly) only expose a blend property on the plane if we have a nv50_wndw_func->blend_set function for the given wndw type. But we need to expose a blend property for all types of planes that can display color formats with an alpha channel. Prepare for doing this by introducing a way of looking up the supported blend modes for a type of wndw by introducing .blend_modes, which describes all possible blending modes nouveau currently supports for a type of wndw. Signed-off-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Fixes: 860e748bddcc ("drm: ensure blend mode supported if pixel format with alpha exposed") Link: https://patch.msgid.link/20260720215058.398210-2-lyude@redhat.com
2026-07-27drm/vmwgfx: validate external BO copy bounds for both stride pathsZack Rusin
vmw_external_bo_copy() trusts caller-supplied offsets, strides, and heights and operates on imported dma-buf vmaps: - The equal-stride memcpy() bound was clamped after subtracting the offsets from dst_size and src_size; an offset larger than the BO size wraps the unsigned subtraction to a huge value and the resulting memcpy() runs off the end of the vmap. dst_stride * height is also a u32 multiplication that can overflow. - The non-equal-stride row-by-row path had no bound at all. The loop touches bytes through offset + (height - 1) * stride + width_in_bytes, with only a WARN_ON(dst_stride < width_in_bytes), and could likewise step past the end of either mapping. The offsets and strides are derived from STDU/SOU plane state, so a configured CRTC submitting a crafted atomic commit on an imported framebuffer can reach this path. Validate the exact row-copy endpoint against each BO's size up front using check_mul_overflow() and check_add_overflow(). Use the bulk memcpy() path only when width_in_bytes covers the whole stride; otherwise copy one row at a time so partial-row updates near the bottom of a framebuffer remain valid. Also reject zero strides and stride < width_in_bytes, both of which the row-by-row path cannot represent safely. Fixes: 50f119925091 ("drm/vmwgfx: Fix prime with external buffers") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin@broadcom.com> Reviewed-by: Ian Forbes <ian.forbes@broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-13-zack.rusin@broadcom.com
2026-07-27drm/vmwgfx: use check_add_overflow for shader size+offset boundZack Rusin
vmw_shader_define() validates the user-supplied shader window against its backing buffer with (u64)buffer->tbo.base.size < (u64)size + (u64)offset drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is near U64_MAX the unsigned addition wraps and the resulting tiny value passes the check. The unbounded offset is then stored in res->guest_memory_offset and forwarded to host SVGA shader-create commands. Use check_add_overflow() to detect the wrap and compare the resulting endpoint against the buffer size. Fixes: 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin@broadcom.com> Reviewed-by: Ian Forbes <ian.forbes@broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-12-zack.rusin@broadcom.com
2026-07-27drm/vmwgfx: skip hash_del_rcu when validation context has no hash tableZack Rusin
vmw_validation_add_resource() calls hash_add_rcu() only when ctx->sw_context is non-NULL, but the doomed-resource error path calls hash_del_rcu() unconditionally. The validation contexts declared with DECLARE_VAL_CONTEXT(_, NULL, 0) in vmwgfx_kms.c, vmwgfx_scrn.c, vmwgfx_stdu.c and vmwgfx_execbuf.c consequently reach a delete for a node that was never added to any hash chain. That is harmless today, but only incidentally so. hash_del_rcu() is hlist_del_init_rcu(), which is guarded by hlist_unhashed(), and vmw_validation_mem_alloc() hands out memory from __GFP_ZERO pages that are never recycled within a context's lifetime, so node->hash.head.pprev is always NULL and the delete does nothing. Neither property is apparent at the call site, and the asymmetry with the add side invites a real bug the first time either one changes. Mirror the condition from the add side so the node is only unlinked when it was actually linked. No functional change. Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin@broadcom.com> Reviewed-by: Ian Forbes <ian.forbes@broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-11-zack.rusin@broadcom.com
2026-07-27drm/vmwgfx: enforce cursor size limits for MOB cursorsZack Rusin
vmw_cursor_plane_atomic_check() bounds cursor width and height only on the legacy update path; the SVGA_CAP2_CURSOR_MOB path -- the default on modern hosts -- accepts any size. When the requested size exceeds SVGA_REG_CURSOR_MAX_DIMENSION or SVGA_REG_MOB_MAX_SIZE, vmw_cursor_mob_get() returns -EINVAL and leaves vps->cursor.mob NULL. Its return value is then discarded in vmw_cursor_plane_prepare_fb(), so the subsequent vmw_cursor_update_mob() calls vmw_bo_map_and_cache(NULL) and oopses inside vmw_bo_map_and_cache_size() on the tbo.base.size load. Reachable from any DRM master via DRM_IOCTL_MODE_CURSOR2 with a sufficiently large width or height (e.g. cursor_max_dim + 1). Reject oversized cursors in atomic_check for both MOB-backed cursor update types. The MOB byte-size limit only applies to the SVGA_CAP2_CURSOR_MOB path (vmw_cursor_mob_size() returns 0 for GB_ONLY); compute the required MOB size in 64-bit to avoid overflow when very large dimensions are requested. In prepare_fb only call vmw_cursor_mob_get()/_map() for VMW_CURSOR_UPDATE_MOB -- the GB_ONLY path uses bo->map.virtual directly and would otherwise be silently downgraded to NONE on hosts without SVGA_CAP2_CURSOR_MOB (where vmw_cursor_mob_get() always returns -EINVAL). Degrade the update to NONE if vmw_cursor_mob_get() or vmw_cursor_mob_map() fails so the update path does not run with a NULL backing MOB. Fixes: 965544150d1c ("drm/vmwgfx: Refactor cursor handling") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin@broadcom.com> Reviewed-by: Ian Forbes <ian.forbes@broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-10-zack.rusin@broadcom.com
2026-07-27drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failureZack Rusin
Two paths through vmw_vkms_init() can leave vmw->crc_workq NULL while still leaving the rest of the driver in a state that calls vmw_vkms_cleanup() at module unload: 1. vmw_host_get_guestinfo(GUESTINFO_VBLANK, ...) failing or returning an oversized buffer -- the common case on hosts without a VBLANK guestinfo entry -- early-returned before the workqueue allocation. 2. alloc_ordered_workqueue() returning NULL on memory pressure. vmw_vkms_cleanup() then calls destroy_workqueue(NULL), which dereferences wq->name and panics. Fix the first case by removing the early return: vmw->vkms_enabled is already false on the rpci-failure path so no work will ever be queued, and allocating the workqueue unconditionally keeps the control flow simple. Fix the second case by guarding the cleanup with a NULL check, since alloc_ordered_workqueue() can still fail under low memory. Fixes: 7b0062036c3b ("drm/vmwgfx: Implement virtual crc generation") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin@broadcom.com> Reviewed-by: Ian Forbes <ian.forbes@broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-9-zack.rusin@broadcom.com
2026-07-27drm/vmwgfx: bound DMA command body size against suffix pointerZack Rusin
vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit. Fixes: 4e4ddd477743 ("drm/vmwgfx: Fix queries if no dma buffer thrashing is occuring.") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin@broadcom.com> Reviewed-by: Ian Forbes <ian.forbes@broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-8-zack.rusin@broadcom.com
2026-07-27drm/vmwgfx: validate DRAW_PRIMITIVES header size before divisionZack Rusin
vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front. Fixes: 7a73ba7469cb ("drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin@broadcom.com> Reviewed-by: Ian Forbes <ian.forbes@broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-7-zack.rusin@broadcom.com
2026-07-27drm/vmwgfx: drop dma_buf reference on foreign-fd prime importZack Rusin
ttm_prime_fd_to_handle() returns -ENOSYS when the imported fd's dma_buf->ops do not match the ttm_object_device's ops, but does so without releasing the reference acquired by dma_buf_get(). Any unprivileged renderD client passing a non-vmwgfx prime fd through the DRM_VMW_GB_SURFACE_REF{,_EXT} path leaks one dma_buf reference per call and indefinitely pins the foreign exporter's GEM resources. Funnel the error path through the existing dma_buf_put() so the reference is always dropped. Fixes: 65981f7681ab ("drm/ttm: Add a minimal prime implementation for ttm base objects") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin@broadcom.com> Reviewed-by: Ian Forbes <ian.forbes@broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-6-zack.rusin@broadcom.com
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-13 16:29:10 +0000