aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/drivers/gpu
AgeCommit message (Collapse)AuthorFilesLines
2026-05-19drm/amdgpu/userq: pin mqd and fw object bo to avoid evictionSunil Khatri1-3/+10
mqd and fw objects are queue core objects which should remain valid and never be unmapped and evicted for user queues to work properly. During eviction if these buffers are evicted the hw continue to use the invalid addresses and caused page faults and system hung. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit a3bbf32a336939a1d21b9561f8e53333b684b7ef)
2026-05-19drm/amdgpu/userq: use drm_exec in amdgpu_userq_fence_read_wptrSunil Khatri1-29/+26
To access the bo from vm mapping first lock the root bo and then the object bo of the mapping to make sure both locks are taken safely. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 3aab50410653fe7eb35eb6f9c2b27e3549ab09e6)
2026-05-19drm/amd/display: Add KUnit test for ISM functionsAlex Hung4-6/+661
Add KUnit tests for three static functions in amdgpu_dm_ism.c: dm_ism_next_state, dm_ism_get_sso_delay, and dm_ism_get_idle_allow_delay. The 32 test cases cover the full FSM transition table, SSO delay calculation with various timings, and hysteresis-based idle allow delay including circular buffer wraparound and old history cutoff logic. Conditionally remove static linkage and export the three functions under CONFIG_DRM_AMD_DC_KUNIT_TEST so the test module can call them. Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Add KUnit test for replayAlex Hung3-0/+210
Add KUnit tests for amdgpu_dm_link_supports_replay() which validates panel replay capability based on link DPCD caps, freesync state, and VSDB info. Nine test cases cover the positive path and each individual failure condition. Export the function under CONFIG_DRM_AMD_DC_KUNIT_TEST and add the amdgpu include path to the tests Makefile so that amdgpu_dm.h can resolve amdgpu_mode.h types under UML. Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Add KUnit test for PSR functionAlex Hung4-1/+266
Add KUnit tests for amdgpu_dm_psr_fill_caps() which validates PSR capability population from DPCD data. Export amdgpu_dm_psr_fill_caps() conditionally when CONFIG_DRM_AMD_DC_KUNIT_TEST is enabled, following the existing pattern used by CRC and HDCP test files. The test covers PSR version mapping, RFB setup time calculation, link training flag, DPCD field passthrough, rate control caps, and power optimization flags. Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Add KUnit test for color helpersAlex Hung4-18/+1209
Add KUnit tests for six pure-logic functions in amdgpu_dm_color.c: amdgpu_dm_fixpt_from_s3132, __is_lut_linear, __drm_ctm_to_dc_matrix, __drm_ctm_3x4_to_dc_matrix, amdgpu_tf_to_dc_tf, and amdgpu_colorop_tf_to_dc_tf. Expose these static functions under CONFIG_DRM_AMD_DC_KUNIT_TEST and add a new amdgpu_dm_color.h header with the KUnit-only prototypes. The test file re-declares the dc and amdgpu transfer function enums locally to avoid pulling in the full DC/amdgpu include chain that fails under UML. 26 test cases cover signed-magnitude to two's complement conversion, LUT linearity detection, CTM-to-DC matrix conversion, and transfer function enum mapping. Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Add KUnit test for colorop TF bitmasksAlex Hung2-0/+162
Add KUnit tests that verify the three supported transfer function bitmask constants exported by amdgpu_dm_colorop.c: amdgpu_dm_supported_degam_tfs, amdgpu_dm_supported_shaper_tfs, and amdgpu_dm_supported_blnd_tfs. Each bitmask is tested for presence of each expected curve flag and absence of any unexpected bits. A cross-check confirms that degam and blnd bitmasks are identical. amdgpu_dm_initialize_default_pipeline() is not tested because it needs a fully initialised drm_plane backed by an amdgpu_device with DC color caps. Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Add KUnit test for HDCP process_outputAlex Hung5-4/+196
Expose process_output() as non-static when CONFIG_DRM_AMD_DC_KUNIT_TEST is enabled and add KUnit tests exercising its full branch logic: - property_validate_dwork is always enqueued (delay=0) - callback_dwork is scheduled when callback_needed is set - callback_dwork is cancelled when callback_stop is set - watchdog_timer_dwork is scheduled when watchdog_timer_needed is set - watchdog_timer_dwork is cancelled when watchdog_timer_stop is set - Both dworks are scheduled independently when both flags are set Assisted-by: Copilot:Claude-Sonnet-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Add KUnit test for CRC functionAurabindo Pillai8-4/+198
DM CRC parsing functions are an easy candidate for exploring the use of KUnit unit-testing frameworks. Add a few tests for the same. The test file and .kunitconfig are placed under amdgpu_dm/tests/ to follow the convention of keeping test code separate from production sources. Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amdgpu: restructure VM state machine v4Christian König4-356/+271
Instead of coming up with more sophisticated names for states a VM BO can be in, group them by the type of BO first and then by the state. So we end with BO type kernel, always_valid and individual and then states evicted, moved and idle. Not much functional change, except that evicted_user is moved back together with the other BOs again which makes the handling in amdgpu_vm_validate() a bit more complex. Also fixes a problem with user queues and amdgpu_vm_ready(). We didn't considered the VM ready when user BOs were not ideally placed, harmless performance impact for kernel queues but a complete show stopper for userqueues. v2: fix a few typos in comments, rename the BO types to make them more descriptive, fix a couple of bugs found during testing v3: squashed together with revert to old status lock handling, looks like the first patch still had some bug which this one here should fix. Fix a missing lock around debugfs printing. v4: fix merge clash pointed out by Prike Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Sunil Khatri <sunil.khatri@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: return error when converting records to nps pages failsGangliang Xie1-3/+2
return error when converting records to nps pages fails Signed-off-by: Gangliang Xie <ganglxie@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: add first record offset checkGangliang Xie1-0/+7
check the upper and lower limits of first record offset Signed-off-by: Gangliang Xie <ganglxie@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amdgpu: check and drop invalid bad page recordsYiPeng Chai1-0/+27
Check and drop invalid bad page records. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: copy ras log data instead of referencing pointersYiPeng Chai6-43/+58
When generating ras cper file, the original data nodes in the ras log ring buffer may be deleted, leading to invalid pointer access. Copy the data from the ras log ring instead of directly referencing the pointers to avoid this issue. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fwCandice Li8-38/+62
Change psp_copy_fw from void to int: return -ENODEV when drm_dev_enter fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Replace open-coded memset/memcpy into fw_pri_buf with psp_copy_fw. Signed-off-by: Candice Li <candice.li@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: add length check for ras command output bufferYiPeng Chai3-11/+24
Add length check for ras command output buffer. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: fix memory leak on ras sw_init failureYiPeng Chai1-4/+16
Fix memory leak on ras sw_init failure. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amdgpu: fix handling in amdgpu_userq_createChristian König1-66/+52
Well mostly the same issues the other code had as well: 1. Memory allocation while holding the userq_mutex lock is forbidden! 2. Things were created/started/published in the wrong order. 3. The reset lock was taken in the wrong order and seems to be unecessary in the first place. 4. Error messages on invalid input parameters can spam the logs. 5. Error messages on memory allocation failures are usually superflous as well. Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Prike Liang <Prike.Liang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: remove unused codeYiPeng Chai3-31/+1
Remove unused code. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: add error handling for seqno operationsYiPeng Chai2-4/+6
Add error handling for seqno operations. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: use mutex to prevent concurrent access conflictsYiPeng Chai1-5/+14
Use mutex to prevent concurrent access conflicts. Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amdgpu: add first record offset checkGangliang Xie1-0/+8
check the upper and lower limits of first record offset Signed-off-by: Gangliang Xie <ganglxie@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amdgpu: Bound GPIO I2C table entry count from VBIOSCandice Li1-6/+18
Reject undersized tables and cap the derived entry count to AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_bus[] or walk an absurd number of entries on corrupt size fields. Signed-off-by: Candice Li <candice.li@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amdgpu: cap ATOM command table nesting depthCandice Li2-0/+14
Cap nesting at 32 levels with execute_depth and return -ELOOP when exceeded. Signed-off-by: Candice Li <candice.li@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: bound CPER record fetch buffer sizeCandice Li3-2/+7
Bound CPER record fetch allocation by buffer size. v2: Drop redundant cap on cper_num and raise GET_CPER_RECORD max buffer size. Suggested-by: YiPeng Chai <YiPeng.Chai@amd.com> Signed-off-by: Candice Li <candice.li@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: Add more IP versions for unirasCe Sun1-0/+2
Add more IP versions for uniras Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amdgpu: Fix memory leak of i2s_pdata in ACP initializationCe Sun2-38/+39
Currently, the i2s_pdata structure is dynamically allocated in acp_hw_init() but never freed in both the error handling path and the acp_hw_fini() cleanup path, causing a permanent memory leak. Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/radeon/evergreen_cs: Add missing NULL prefix check in surface checkVitaliy Triang3l Kuzmin1-2/+4
'evergreen_surface_check' is called with a NULL warning prefix when handling potentially recoverable issues or just to compute the alignment requirements, and 'evergreen_surface_check' is called again in case of failure (with the correct prefix, as opposed to NULL), therefore, the initial check must not print a warning, because the surface may be accepted successfully after having been corrected, however if it isn't, the final check will print the warning anyway. The surface check functions specific to array modes already implement this behavior, but the 'evergreen_surface_check' function itself doesn't. This is also supposed to fix the "'%s' directive argument is null [-Werror=format-overflow=]" compiler warning. Fixes: 285484e2d55e ("drm/radeon: add support for evergreen/ni tiling informations v11") Reported-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Vitaliy Triang3l Kuzmin <ml@triang3l.ru> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: Fix SMU EEPROM record field decodingXiang Liu2-6/+10
The SMU EEPROM read paths pass byte-sized record field addresses to mca_ipid_parse(), whose outputs are u32 pointers. Writing through those widened pointers can clobber adjacent fields and bytes beyond the record storage. Parse the IPID values into local u32 temporaries instead, then explicitly narrow the values when storing them in the EEPROM record. Signed-off-by: Xiang Liu <xiang.liu@amd.com> Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: reset CPER ring on corrupt entry sizeXiang Liu1-3/+15
When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does not advance rptr after dword conversion and pointer masking. In that case the recovery loop keeps testing the same location while holding the CPER ring mutex. This can hang the worker that is writing the next CPER record. Detect a no-progress rptr update and reset the CPER ring to an empty state instead. This drops the corrupt contents and lets the writer leave the recovery path without spinning. Signed-off-by: Xiang Liu <xiang.liu@amd.com> Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/xe/oa: Fix exec_queue leak on width check in stream openShuicheng Lin1-2/+4
In xe_oa_stream_open_ioctl(), when param.exec_q->width > 1 the function returns -EOPNOTSUPP directly, skipping the existing err_exec_q cleanup path. The exec_queue reference obtained by xe_exec_queue_lookup() is leaked. The exec queue holds a reference on the xe_file, which is only dropped during queue teardown. The leaked lookup ref is not on the file's exec_queue xarray, so file close cannot release it. This keeps both the exec queue and the file private state pinned indefinitely. Jump to err_exec_q instead of returning directly so the reference is released. Fixes: f0ed39830e60 ("xe/oa: Fix query mode of operation for OAR/OAC") Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com> Link: https://patch.msgid.link/20260514203210.593488-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-05-19drm/amdgpu: userq_va_mapped should remain true once doneSunil Khatri3-14/+7
Multiple queues needs these bo_va objects belonging to the same uq_mgr. So once they are mapped lets not unmap them as at any point of time any of the queues might be using it. Also userq_va_mapped should be a boolean than atomic. Signed-off-by: Sunil Khatri <sunil.khatri@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amdgpu: avoid integer overflow in VA range checkCe Sun1-2/+2
The original addition operation in 64-bit unsigned type may encounter overflow situations. To prevent such issues and safely reject invalid inputs, the check_add_overflow() function is used. Signed-off-by: Ce Sun <cesun102@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/ras: Fix UMC error address allocation leakXiang Liu1-0/+2
amdgpu_umc_handle_bad_pages() allocates err_data->err_addr before querying UMC error information. In the direct and firmware query paths, the pointer is reassigned to a fresh allocation before the original buffer is released, so the initial allocation is leaked on each handled event. Free the existing buffer before replacing it in those query paths so the function exit cleanup only owns the active allocation. Signed-off-by: Xiang Liu <xiang.liu@amd.com> Reviewed-by: Stanley.Yang <Stanley.Yang@amd.com> Reviewed-by: Tao Zhou <tao.zhou1@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 resetYifan Zhang5-0/+55
During Mode 1 reset, the ASIC undergoes a reset cycle and becomes temporarily inaccessible via PCIe. Any attempt to access framebuffer or MMIO registers during this window can result in uncompleted PCIe transactions, leading to NMI panics or system hangs. To prevent this, Unmap all of the applications mappings of the framebuffer and doorbell BARs before mode1 reset. Also prevent new mappings from coming in during the reset process. v2: remove inode in kfd_dev (Christian) v3: correct unmap offset (Felix), remove prevent new mappings part to avoid deadlock (Christian) Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Promote DC to 3.2.383Taimur Hassan1-1/+1
This version brings along the following updates: - Add amdgpu_dm KUnit test for: * CRC function * HDCP process_output * colorop TF bitmasks * color helpers * PSR and Replay functions * ISM functions - Fix eDP receiver ready status check in T7 sequence - Enable dcn42 pstate pmo - Refactor PSR. Replay and ABM functionality into dedicated power modules - Fix assertion due to disable/enable CM blocks - Enable additional wait for pipe pending checks - Fix ISM dc_lock deadlock during suspend - Use lockdep_assert_held() for dc_lock check - Fix clear PSR config flow - Exclude the MST overhead from BW deallocation - Allow power up even w/ powergating disabled on DCN42 - Fix integer overflow in bios_get_image() - Validate GPIO pin LUT table size before iterating - Add Auxless-ALPM support in VESA Panel Replay - Add debug option for replay ESD recovery. - Validate payload length and link_index in dc_process_dmub_aux_transfer_async. - Add ADDR3 swizzle modes. Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com> Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Add ADDR3 swizzle modesWenxian Wang2-1/+5
[Why] New swizzle modes are needed for ADDR3 block support. [How] Add DC_ADDR3_SW_64KB_2D_Z and DC_ADDR3_SW_256KB_2D_Z enum values to dc_hw_types.h. Reviewed-by: Ilya Bakoulin <ilya.bakoulin@amd.com> Signed-off-by: Wenxian Wang <wenxian.wang@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_asyncHarry Wentland1-1/+5
[Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy. Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access. Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used. Assisted-by: GitHub Copilot:Claude claude-4-opus Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Add debug option for replay ESD recoveryWei-Guang Li2-6/+9
[Why&How] Add a new debug option "enable_replay_esd_recovery" to control whether to enable the replay ESD recovery feature. Reviewed-by: Robin Chen <robin.chen@amd.com> Reviewed-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Wei-Guang Li <wei-guang.li@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Add Auxless-ALPM support in VESA Panel ReplayLeon Huang1-0/+13
[How] Add Auxless-ALPM data in VESA PR initialization Reviewed-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: Leon Huang <Leon.Huang1@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Validate GPIO pin LUT table size before iteratingHarry Wentland1-0/+9
[Why&How] The GPIO pin table parsers in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() derive an element count from the VBIOS table_header.structuresize field, then iterate over gpio_pin[] entries. However, GET_IMAGE() only validates that the table header itself fits within the BIOS image. If the VBIOS reports a structuresize larger than the actual mapped data, the loop reads past the end of the BIOS image, causing an out-of-bounds read. Fix this by calling bios_get_image() to validate that the full claimed structuresize is accessible within the BIOS image before entering the loop in both functions. Assisted-by: GitHub Copilot:claude-opus-4-6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Fix integer overflow in bios_get_image()Harry Wentland1-3/+6
[Why&How] The bounds check in bios_get_image() computes 'offset + size' using unsigned 32-bit arithmetic before comparing against bios_size. If a VBIOS image contains a near-UINT32_MAX offset the addition wraps to a small value, the comparison passes, and the function returns a wild pointer past the VBIOS mapping. Additionally, the comparison uses '<' (strict), which incorrectly rejects the valid exact-fit case where offset + size == bios_size. Fix both issues by restructuring the check to avoid the addition entirely: first reject if offset alone exceeds bios_size, then check size against the remaining space (bios_size - offset). This eliminates the overflow and correctly permits exact-fit accesses. Assisted-by: GitHub Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Refactor Replay functionality into dedicated power_replay moduleLohita Mudimela6-874/+921
[Why] Extract all Replay related functions from power.c and power_helpers.c into a new power_replay.c module for better code organization and maintainability. [How] Create new power_replay.c file containing Replay-related functions moved from power.c and power_helpers.c . Update mod_power.h with function declarations. Maintain forward declaration for type compatibility. Reviewed-by: Robin Chen <robin.chen@amd.com> Signed-off-by: Lohita Mudimela <lohita.mudimela@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Allow power up when PG disallowed in driverCharlene Liu1-19/+24
[Why] Do not exit early dcn42 pg control functions on power up for pipe PG failsafe. Reviewed-by: Leo Chen <leo.chen@amd.com> Signed-off-by: Charlene Liu <Charlene.Liu@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Exclude the MST overhead from BW deallocationCruise Hung1-21/+20
[Why] The MST overhead was incorrectly included in the requested BW during BW deallocation. [How] Exclude the MST overhead from BW deallocation. Reviewed-by: Wenjing Liu <wenjing.liu@amd.com> Reviewed-by: Meenakshikumar Somasundaram <meenakshikumar.somasundaram@amd.com> Signed-off-by: Cruise Hung <Cruise.Hung@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Use lockdep_assert_held() for dc_lock checkRay Wu1-2/+2
[Why] mutex_is_locked() only tells whether *some* task holds the mutex, not the current one, so the existing ASSERT can silently pass when the caller violates the contract. [How] Use the kernel's lockdep debugging utility (include/linux/lockdep.h) and replace ASSERT(mutex_is_locked(&dm->dc_lock)) with lockdep_assert_held(&dm->dc_lock), which checks the current task's held-lock stack. Reviewed-by: Sun peng (Leo) Li <sunpeng.li@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Fix ISM dc_lock deadlock during suspendRay Wu3-12/+70
[Why] System hang observed during suspend/resume while video is playing. amdgpu_dm_ism_disable() is called under dc_lock and waits for ISM delayed work via disable_delayed_work_sync(). The work handlers themselves take dc_lock, producing an ABBA deadlock when a worker is in flight at suspend time. [How] Split the disable path into two phases with opposite locking contracts: 1. amdgpu_dm_ism_disable() -- quiesces workers, must NOT hold dc_lock. 2. amdgpu_dm_ism_force_full_power() (new) -- drives the ISM FSM back to FULL_POWER_RUNNING, must hold dc_lock. Reviewed-by: Sun peng (Leo) Li <sunpeng.li@amd.com> Signed-off-by: Ray Wu <ray.wu@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Enable additional wait for pipe pending checksAric Cyr12-7/+21
[why] In cases where there are two FULL updates within the same display frame, it's possible for some blocks to be programmed a second time without having been latched completely from the first programming. DCN 3.5 and up already work around this with additional validation checks for frame count and defer as needed via fsleep. [how] Enabled existing pipe checks generically for all DCN versions to avoid HW programming hazards. Also removed redundant max_frame_count which can be determined by the register mask and shift. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Aric Cyr <Aric.Cyr@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Fix assertion due to disable/enable CM blocksAric Cyr3-0/+5
[why] Some dc state transitions can result in CM blocks being disabled, then re-enabled. The disable will set a defer bit, but re-enable will not clear it. When optimizing later, an assert will be hit due to incorrect expected HW state. [how] Clear defer bits if the block is re-enabled before optimization is executed. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Aric Cyr <Aric.Cyr@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-05-19drm/amd/display: Refactor PSR functionality into dedicated power_psr moduleLohita Mudimela7-837/+785
[Why] Extract all PSR (Panel Self Refresh) related functions from power.c into a new power_psr.c module for better code organization and maintainability. [How] Create new power_psr.c file containing all PSR-related functions moved from power.c. Remove static qualifier from shared functions to enable cross-file access: - psr_context_to_mod_power_psr_context: Convert PSR context to module power PSR context - map_index_from_stream: Map stream to power entity index - delay_two_frames: Wait for two frame periods Add function declarations to header. Maintain forward declaration of struct core_power for type compatibility. Reviewed-by: Anthony Koo <anthony.koo@amd.com> Signed-off-by: Lohita Mudimela <lohita.mudimela@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.