aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/drivers/gpu
AgeCommit message (Collapse)AuthorFilesLines
2026-05-18drm/i915/dp: Use revision field of AS SDP data structureAnkit Nautiyal2-5/+5
Use the revision field of struct drm_dp_as_sdp instead of current hardcoding for the AS SDP revisions. Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260511123218.1589830-3-ankit.k.nautiyal@intel.com
2026-05-18drm/i915/dp: Fix readback for target_rr in Adaptive Sync SDPAnkit Nautiyal1-1/+1
Correct the bit-shift logic to properly readback the 10 bit target_rr from DB3 and DB4. v2: Align the style with readback for vtotal. (Ville) Fixes: 12ea89291603 ("drm/i915/dp: Add Read/Write support for Adaptive Sync SDP") Cc: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com> Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260511123218.1589830-2-ankit.k.nautiyal@intel.com
2026-05-16drm/msm/snapshot: fix dumping of the unaligned regionsDmitry Baryshkov1-6/+18
The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code (where most of the regions are aligned), but fails for snapshotting of the DSI data (because DSI data region is shifted by 4 bytes). Fix the code by removing length alignment and by accurately printing last registers in the region. While reworking the code also fix the 16x memory overallocation in msm_disp_state_dump_regs(). Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot") Reported-by: Salendarsingh Gaud <sgaud@qti.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/725449/ Message-ID: <20260516-msm-fix-dsi-dump-2-v2-1-9e49fb2d240e@oss.qualcomm.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-05-16drm/i915/irq: add intel_display_irq_handler() to irq funcsJani Nikula4-28/+38
Call the platform specific display irq handler hooks via intel_display_irq_handler(). v3: Pure vfunc change (Ville) v2: Rebase, handle LPE audio in ack (Ville) Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/d728f04a47532898c278ef208692ea173b446106.1778688699.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-16drm/i915/irq: add intel_display_irq_ack() to irq funcsJani Nikula3-11/+22
Call the platform specific display irq ack hooks, if any, via intel_display_irq_ack(). Check for HAS_DISPLAY() in intel_display_irq_ack() for completeness even though fusing is not possible on the platforms in question. v3: - Pure vfunc change (Ville) v2: - Include LPE audio in the ack part - Check for HAS_DISPLAY() Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/a72974d66f7696ca35380b44f13f938b2d4d690d.1778688699.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-16drm/i915/irq: add platform specific display irq handler functionsJani Nikula4-48/+79
Add a number of *_display_irq_handler() functions to group together the various display irq handler parts for the platforms, to declutter the core i915 irq code from the details. Add master_ctl to struct intel_display_irq_state, and pass the state pointer to the handlers where necessary. The handler function signatures are intentionally the same to allow for more refactoring. Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/5088a9a658ce9a57049c999ee2ebababd7536b6c.1778688699.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-16drm/i915/irq: add platform specific display irq ack functionsJani Nikula3-101/+102
Add i9xx_display_irq_ack() and vlv_display_irq_ack() to group together the various irq ack parts for the platforms, to declutter the core i915 irq code from the details. Introduce struct intel_display_irq_state to group together all the data the ack functions need. In the follow-up, this state will be passed on to similar platform specific handler functions. Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/30d2f1c0c6acd997b841f0dfc538f703e064998d.1778688699.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-16drm/i915/irq: add intel_display_irq_postinstall() to irq funcsJani Nikula4-24/+31
Call the platform specific display irq postinstall hooks via intel_display_irq_postinstall(). Relocate the gen11 HAS_DISPLAY() check to intel_display_irq_postinstall(), as the funcs pointer won't be initialized for no display. v2: - relocate HAS_DISPLAY() (Sashiko) Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/65f1ad73628fb6dbdf6e782493eaecb1d61abaf7.1778688699.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-16drm/i915/irq: add display irq funcs, start with intel_display_irq_reset()Jani Nikula5-25/+63
Introduce display irq hooks with struct intel_display_irq_funcs, and add the ->reset hook as the first thing. Call the reset hooks from i915 and xe core via intel_display_irq_reset(). Relocate the gen8 and gen11 HAS_DISPLAY() check to intel_display_irq_reset(), as the funcs pointer won't be initialized for no display. Note: We're increasingly moving to the territory of not touching display at all if there's no display or it has been fused off. Which is good, but care must be taken to not have hardware setup required also for no display cases in display code. Also note that the line is fuzzy for older platforms, but there we also don't have fusing. v2: - make the structs static const (Sashiko) - relocate HAS_DISPLAY() (Sashiko) Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/f9d75e8af92b5550a9d07f29491be5313b7c866b.1778688699.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-16drm/i915/irq: constify pipe stats parametersJani Nikula2-6/+6
The pipe stat irq handling doesn't need to modify the pipe stats arrays. Make them const. Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/3b7ad6be706ed757b53c6c4e06a3410f6f7520e0.1778688699.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-16drm/i915/irq: deduplicate dg1_de_irq_postinstall() and gen11_de_irq_postinstall()Jani Nikula3-11/+1
dg1_de_irq_postinstall() and gen11_de_irq_postinstall() are exactly the same. Remove dg1_de_irq_postinstall() and call gen11_de_irq_postinstall() instead. Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/bbbec68fe398175b1609049771810fb6a8b7b7e6.1778688699.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-16drm/xe/display: fix oops in suspend/shutdown without displayJani Nikula1-2/+9
The xe driver keeps track of whether to probe display, and whether display hardware is there, using xe->info.probe_display. It gets set to false if there's no display after intel_display_device_probe(). However, the display may also be disabled via fuses, detected at a later time in intel_display_device_info_runtime_init(). In this case, the xe driver does for_each_intel_crtc() on uninitialized mode config in xe_display_flush_cleanup_work(), leading to a NULL pointer dereference, and generally calls display code with display info cleared. Check for intel_display_device_present() after intel_display_device_info_runtime_init(), and reset xe->info.probe_display as necessary. Also do unset_display_features() for completeness, although display runtime init has already done that. This will need to be unified across all cases later. Move intel_display_device_info_runtime_init() call slightly earlier, similar to i915, to avoid a bunch of unnecessary setup for no display cases. Note #1: The xe driver has no business doing low level display plumbing like for_each_intel_crtc() to begin with. It all needs to happen in display code. Note #2: The actual bug is present already in commit 44e694958b95 ("drm/xe/display: Implement display support"), but the oops was likely introduced later at commit ddf6492e0e50 ("drm/xe/display: Make display suspend/resume work on discrete"). Fixes: 44e694958b95 ("drm/xe/display: Implement display support") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7904 Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/6150 Cc: stable@vger.kernel.org # v6.8+ Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260515160920.1082842-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-05-16drm: Replace old pointer to new idrEdward Adam Davis1-5/+2
Commit 5e28b7b94408 introduced a logical error by failing to replace the newly generated IDR pointer to old id's pointer at the correct location within the "change handle" logic; this resulted in the issue reported by syzbot [1]. Specifically, the new IDR object pointer is intended to replace the original id's pointer during the normal execution flow. Additionally, an unnecessary conditional check for the ret exit path has been removed. [1] !RB_EMPTY_ROOT(&prime_fpriv->dmabufs) WARNING: drivers/gpu/drm/drm_prime.c:224 at drm_prime_destroy_file_private+0x48/0x60 drivers/gpu/drm/drm_prime.c:224, CPU#0: syz.0.17/5833 Call Trace: drm_file_free.part.0+0x7e6/0xcc0 drivers/gpu/drm/drm_file.c:269 drm_file_free drivers/gpu/drm/drm_file.c:237 [inline] drm_close_helper.isra.0+0x186/0x200 drivers/gpu/drm/drm_file.c:290 drm_release+0x1ab/0x360 drivers/gpu/drm/drm_file.c:438 Fixes: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") Reported-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d7c9eed171647e421013 Cc: stable@vger.kernel.org Tested-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/tencent_C267296443AAA4567771176886DFF364A305@qq.com
2026-05-16Merge tag 'drm-misc-fixes-2026-05-15' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixesDave Airlie8-40/+61
Short summary of fixes pull: bridge: - imx8qxp-pxl2dpi: avoid ERR_PTR with device_node cleanup gma500: - oaktrail_lvds: fix i2c handling loongson: - use managed cleanup for connector polling panfrost: - handle results from reservation locking correctly qaic: - check for integer overflows in mmap logic rocket: - handle results from reservation locking correctly ttm: - avoid infinite loop in swap out - avoid infinite loop in BO shrinking - convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260515070816.GA88575@2a02-2455-9062-2500-7dec-552d-233d-9fe0.dyn6.pyur.net
2026-05-16Merge tag 'drm-xe-fixes-2026-05-14' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixesDave Airlie11-231/+222
- Madvise fix around purgeability tracking (Arvind) - Restore engine mask for specific blitter style (Roper) - Couple UAF fixes (Auld) - Drop unused ggtt_balloon field (Wajdeczko) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/agXWkM3Y98bqt6TG@intel.com
2026-05-15drm/xe/reg_sr: Do sanity check for MCR vs non-MCRGustavo Sousa6-8/+139
The type struct xe_reg_mcr exists to ensure that the correct API is used when handling MCR registers. However, for the register save/restore functionality, the RTP processing always cast the register to a struct xe_reg and then apply_one_mmio() selects the MMIO API based on the "mcr" field of the register instance. This allows the developer to commit mistakes like passing a MCR register for an RTP action for a GT where the respective register is not MCR; and vice-versa. To capture such scenarios, do a sanity check in xe_reg_sr_add() that, upon an inconsistency: - "fixes" the register type by favoring what we have in our MCR range tables instead of what the developer selected for the save/restore entry; - raises a notice-level message to inform about the inconsistency. Note: As a collateral of this change, we need to include MCR initialization in xe_wa_test.c, otherwise a bunch of test cases end up failing because xe_gt_mcr_check_reg() will always return false, meaning that will incorrectly say that a MCR register is not MCR. v2: - Downgrade messages to notice level so as not to block CI execution when inconsistencies are found. (Matt) - Add missing EXPORT_SYMBOL_IF_KUNIT() calls. (Gustavo) Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260514-rtp-mcr-check-v3-7-30dd47855fee@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-05-15drm/xe/mcr: Extract reg_in_steering_type_ranges()Gustavo Sousa1-18/+23
The logic to check if a register falls within one of the ranges for a steering type is already duplicated in xe_gt_mcr_get_nonterminated_steering(). We will also want to use that same logic in another upcoming function. Let's factor out that logic and put it into a function named reg_in_steering_type_ranges(). Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260514-rtp-mcr-check-v3-6-30dd47855fee@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-05-15drm/xe/kunit: Use KUNIT_EXPECT_EQ() in xe_wa_gt()Gustavo Sousa1-1/+1
Use KUNIT_EXPECT_EQ() in xe_wa_gt() as reg_sr errors in one GT do not impact the next GT in the test. Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260514-rtp-mcr-check-v3-5-30dd47855fee@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-05-15drm/xe: Extract xe_hw_engine_setup_reg_lrc()Gustavo Sousa3-7/+15
The steps for processing RTP rules that build up an engine's reg_lrc arguably belongs to xe_hw_engine.c and should be encapsulated into a function in that unit. Move that logic to a new function called xe_hw_engine_setup_reg_lrc(). Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260514-rtp-mcr-check-v3-4-30dd47855fee@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-05-15drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN4Gustavo Sousa3-3/+4
The register COMMON_SLICE_CHICKEN4 is a MCR register on both Xe2 and Xe3. Let's make sure to define a MCR version of it and use it for the relevant IP versions. Use XEHP_ as prefix for the register name, since it is MCR as of Xe_HP. v2: - Also change for one entry in lrc_tunnings, which was caught by manual testing and add corresponging Fixes tag in commit message. (Gustavo) Fixes: 8d6f16f1f082 ("drm/xe: Extend Wa_22021007897 to Xe3 platforms") Fixes: e5c13e2c505b ("drm/xe/xe2hpg: Add Wa_22021007897") Fixes: 8ccf5f6b2295 ("drm/xe/tuning: Apply windower hardware filtering setting on Xe3 and Xe3p") Bspec: 66534, 71185, 74417 Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260514-rtp-mcr-check-v3-3-30dd47855fee@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-05-15drm/xe: Define and use MCR version of COMMON_SLICE_CHICKEN1Gustavo Sousa2-1/+2
The register COMMON_SLICE_CHICKEN1 is a MCR register on Xe2. Let's make sure to define a MCR version of it and use it for the relevant IP versions. Use XEHP_ as prefix for the register name, since it is MCR as of Xe_HP. Fixes: a5d221924e13 ("drm/xe/xe2_hpg: Add set of workarounds") Fixes: 9f18b55b6d3f ("drm/xe/xe2: Add workaround 18033852989") Bspec: 66534, 71185 Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260514-rtp-mcr-check-v3-2-30dd47855fee@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-05-15drm/xe: Define CACHE_MODE_1 as MCR registerGustavo Sousa1-1/+1
CACHE_MODE_1 is a MCR register for all platforms that currently use it in the Xe driver. Use XE_REG_MCR() when defining it. Fixes: 8cd7e9759766 ("drm/xe: Add missing DG2 lrc workarounds") Fixes: ff063430caa8 ("drm/xe/mtl: Add some initial MTL workarounds") Bspec: 66534, 67788 Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260514-rtp-mcr-check-v3-1-30dd47855fee@intel.com Signed-off-by: Gustavo Sousa <gustavo.sousa@intel.com>
2026-05-15drm/xe/pf: Fix CFI failure in debugfs accessMohanram Meenakshisundaram2-2/+6
Reading debugfs file (/sys/kernel/debug/dri/0/gt*/pf/adverse_events) with CFI (Control Flow Integrity) enabled, the kernel panics at xe_gt_debugfs_simple_show+0x82/0xc0. xe_gt_debugfs_simple_show() declare a function pointer expecting int return type, but xe_gt_sriov_pf_monitor_print_events() is void return type, leading to CFI failure and kernel panic. [507620.973657] CFI failure at xe_gt_debugfs_simple_show+0x82/0xc0 [xe] (target: xe_gt_sriov_pf_monitor_print_events+0x0/0x130 [xe]; expected type: 0xd72c7139) Fix xe_gt_sriov_pf_monitor_print_events() function by updating to return an int type. Fixes: 1c99d3d3edab ("drm/xe/pf: Expose PF monitor details via debugfs") Signed-off-by: Mohanram Meenakshisundaram <mohanram.meenakshisundaram@intel.com> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20260514174918.1556357-2-mohanram.meenakshisundaram@intel.com
2026-05-15drm/xe/vf: Fix signature of print functionsMichal Wajdeczko2-9/+21
We have plugged-in existing VF print functions into our GT debugfs show helper as-is, but we missed that the helper expects functions to return int, while they were defined as void. This can lead to errors being reported when CFI is enabled. Fixes: 63d8cb8fe3dd ("drm/xe/vf: Expose SR-IOV VF attributes to GT debugfs") Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: Mohanram Meenakshisundaram <mohanram.meenakshisundaram@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Link: https://patch.msgid.link/20260514155726.7165-1-michal.wajdeczko@intel.com
2026-05-15drm/msm: Fix shrinker deadlockDaniel J Blueman1-24/+16
With PROVE_LOCKING on an Snapdragon X1 and VM reclaim pressure, we see: ====================================================== WARNING: possible circular locking dependency detected 7.0.0-debug+ #43 Tainted: G W ------------------------------------------------------ kswapd0/82 is trying to acquire lock: ffff800080ec3870 (reservation_ww_class_acquire){+.+.}-{0:0}, at: msm_gem_shrinker_scan+0x17c/0x400 [msm] but task is already holding lock: ffffc31709b263b8 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x88/0x988 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (fs_reclaim){+.+.}-{0:0}: __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 fs_reclaim_acquire+0xd0/0xf0 dma_resv_lockdep+0x224/0x348 do_one_initcall+0x84/0x5d0 do_initcalls+0x194/0x1d8 kernel_init_freeable+0x128/0x180 kernel_init+0x2c/0x160 ret_from_fork+0x10/0x20 -> #1 (reservation_ww_class_mutex){+.+.}-{4:4}: __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 dma_resv_lockdep+0x1a8/0x348 do_one_initcall+0x84/0x5d0 do_initcalls+0x194/0x1d8 kernel_init_freeable+0x128/0x180 kernel_init+0x2c/0x160 ret_from_fork+0x10/0x20 -> #0 (reservation_ww_class_acquire){+.+.}-{0:0}: check_prev_add+0x114/0x790 validate_chain+0x594/0x6f0 __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 drm_gem_lru_scan+0x1ac/0x440 msm_gem_shrinker_scan+0x17c/0x400 [msm] do_shrink_slab+0x150/0x4a0 shrink_slab+0x144/0x460 shrink_one+0x9c/0x1b0 shrink_many+0x27c/0x5c0 shrink_node+0x344/0x550 balance_pgdat+0x2c0/0x988 kswapd+0x11c/0x318 kthread+0x10c/0x128 ret_from_fork+0x10/0x20 other info that might help us debug this: Chain exists of: reservation_ww_class_acquire --> reservation_ww_class_mutex --> fs_reclaim Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(fs_reclaim); lock(reservation_ww_class_mutex); lock(fs_reclaim); lock(reservation_ww_class_acquire); *** DEADLOCK *** 1 lock held by kswapd0/82: #0: ffffc31709b263b8 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x88/0x988 stack backtrace: CPU: 4 UID: 0 PID: 82 Comm: kswapd0 Tainted: G W 7.0.0-debug+ #43 PREEMPT(full) Tainted: [W]=WARN Hardware name: LENOVO 21BX0016US/21BX0016US, BIOS N3HET94W (1.66 ) 09/15/2025 Call trace: show_stack+0x20/0x40 (C) dump_stack_lvl+0x9c/0xd0 dump_stack+0x18/0x30 print_circular_bug+0x114/0x120 check_noncircular+0x178/0x198 check_prev_add+0x114/0x790 validate_chain+0x594/0x6f0 __lock_acquire+0x4d0/0xad0 lock_acquire.part.0+0xc4/0x248 lock_acquire+0x8c/0x248 drm_gem_lru_scan+0x1ac/0x440 msm_gem_shrinker_scan+0x17c/0x400 [msm] do_shrink_slab+0x150/0x4a0 shrink_slab+0x144/0x460 shrink_one+0x9c/0x1b0 shrink_many+0x27c/0x5c0 shrink_node+0x344/0x550 balance_pgdat+0x2c0/0x988 kswapd+0x11c/0x318 kthread+0x10c/0x128 ret_from_fork+0x10/0x20 kswapd0 holding fs_reclaim calls the MSM shrinker, which calls dma_resv_lock. This in turn acquires fs_reclaim. Fix this deadlock by using dma_resv_trylock() instead, dropping the subsequently unused passed wait-wound lock 'ticket'. Cc: stable@vger.kernel.org Signed-off-by: Daniel J Blueman <daniel@quora.org> Fixes: fe4952b5f27c ("drm/msm: Convert vm locking") Patchwork: https://patchwork.freedesktop.org/patch/723564/ Message-ID: <20260508065722.18785-1-daniel@quora.org> [rob: fixup compile errors, replace lockdep splat with something legible] Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-05-15drm/msm: Don't use UTS_RELEASE directlyUwe Kleine-König (The Capable Hub)2-4/+4
UTS_RELEASE evaluates to a static string and changes quite easily (e.g. uncommitted changes in the source tree or new commits). So when checking if a patch introduces changes to the resulting binary each usage of UTS_RELEASE is source of annoyance. Instead of using UTS_RELEASE directly use init_utsname()->release which evaluates to the same string but with that a change of UTS_RELEASE doesn't affect msm_disp_snapshot_util.o or msm_gpu.o. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Patchwork: https://patchwork.freedesktop.org/patch/721948/ Message-ID: <20260428144553.1103785-2-u.kleine-koenig@baylibre.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-05-15drm/loongson: Use managed KMS pollingMyeonghun Pak1-1/+1
lsdc_pci_probe() initializes KMS polling before setting up vblank support, requesting the IRQ and registering the DRM device. If any of those later steps fails, probe returns without finalizing polling. The driver also never finalizes polling on regular removal. Use drmm_kms_helper_poll_init() so polling is tied to the DRM device lifetime and automatically finalized on probe failure and device removal. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: f39db26c5428 ("drm: Add kms driver for loongson display controller") Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim <ae878000@gmail.com> Signed-off-by: Ijae Kim <ae878000@gmail.com> Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Jianmin Lv <lvjianmin@loongson.cn> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Myeonghun Pak <mhun512@gmail.com> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patch.msgid.link/20260513065706.23803-1-mhun512@gmail.com
2026-05-15Merge tag 'drm-intel-next-2026-05-14' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-nextDave Airlie77-668/+888
- A Revert of a Kconfig patch that broke some builds (Jani) - New fb_pin abstraction for xe and i915 fb transparent handling (Ville, Tvrtko) - Skip inactive MST connectors on HDCP cases (Suraj) - Reduce redundant intel_panel_fixed_mode (Ankit) - Some general fixes (Imre, Chaitanya) - Reorganize display documentation (Jani) - Start switching to display specific reg types (Jani) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/agXbLMtMECnKy-YV@intel.com
2026-05-15Merge tag 'drm-xe-next-2026-05-14' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-nextDave Airlie42-482/+771
Driver Changes: - drm/xe/cri: Add new PCI IDs (Balasubramani Vivekanandan) - drm/xe/memirq: Enable GT_MI_USER_INTERRUPT only (Michal Wajdeczko) - drm/xe/memirq: Update interrupt handler logic (Michal Wajdeczko) - drm/xe: Drop unused ggtt_balloon field (Michal Wajdeczko) - drm/xe: Refactor emit_xy_fast_copy and emit_mem_copy functions (Balasubramani Vivekanandan) - drm/xe: Refactor emit_clear_link_copy (Balasubramani Vivekanandan) - drm/xe: Refactor emit_clear_main_copy (Balasubramani Vivekanandan) - drm/xe/devcoredump: Drop a FIXME in devcoredump (Shekhar Chauhan) - drm/xe/oa: MERTOA Wa_14026779378 (Ashutosh Dixit) - drm/xe/oa: Add val arg to xe_oa_is_valid_config_reg (Ashutosh Dixit) - drm/xe/oa: MERTOA Wa_14026746987 (Ashutosh Dixit) - drm/xe/oa: Refactor oa_unit_supports_oa_format (Ashutosh Dixit) - drm/xe/dma-buf: fix UAF with retry loop (Matthew Auld) - drm/xe/dma-buf: handle empty bo and UAF races (Matthew Auld) - drm/xe/multi_queue: Whitelist QUEUE_TIMESTAMP register (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Use QUEUE_TIMESTAMP as job timestamp for multi-queue (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Add trace event for the multi queue timestamp (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Capture queue run times for active queues (Umesh Nerlige Ramappa) - drm/xe/lrc: Refactor out engine id to hwe conversion (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Add helpers to access CS QUEUE TIMESTAMP from lrc (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Store primary LRC and position info in LRC (Umesh Nerlige Ramappa) - drm/xe/multi_queue: Refactor check for multi queue support for engine class (Umesh Nerlige Ramappa) - drm/xe/lrc: Refactor xe_lrc_timestamp to simplify logic (Umesh Nerlige Ramappa) - drm/xe: Add timestamp_ms to LRC snapshot (Matthew Brost) - drm/xe/lrc: Use 64 bit ctx timestamp in the LRC snapshot (Umesh Nerlige Ramappa) - drm/xe/eustall: Return ENODEV from read if EU stall registers get reset (Harish Chegondi) - drm/xe/multi_queue: Refactor CGP_SYNC send path (Niranjana Vishwanathapura) - drm/xe/multi_queue: Remove redundant assignment in guc_exec_queue_run_job (Niranjana Vishwanathapura) - drm/xe: Make decision to use Xe2-style blitter instructions a feature flag (Matt Roper) - drm/xe: Convert stolen memory over to ttm_range_manager (Sanjay Yadav) - drm/xe/madvise: Track purgeability with BO-local counters (Arvind Yadav) - drm/xe/xe_survivability: Simplify runtime survivability error handling (Mallesh Koujalagi) - drm/xe/guc: Exclude indirect ring state page from ADS engine state size (Satyanarayana K V P) - drm/xe/hw_error: Cleanup array map (Raag Jadav) - drm/xe/pf: Fix MMIO access using PF view instead of VF view during migration (Shuicheng Lin) - drm/xe/pf: Fix EAGAIN sign in pf_migration_consume() (Shuicheng Lin) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/agXMKRRl1oxB204x@fedora
2026-05-15Merge tag 'drm-misc-next-2026-05-14' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-nextDave Airlie35-184/+316
drm-misc-next for v7.2-rc1: UAPI Changes: - Update fourcc descriptions of BG(R) floating formats. - Add deferred mapping support to virtio. Cross-subsystem Changes: - Update lontium lt9211 bindings. Core Changes: - Bugfixes and cleanups to pagemap, dp/mst. - Add lockdep annotations to gpu buddy manager. - Updates to drm/dp for PR + VRR. - Improve documentation's table of contents. - Bump fpfn and lpfn in ttm to 64-bits. Driver Changes: - Assorted bugfixes, cleanups and updates to panthor, nouveau, qaic, hisilicon. - Add support for CMN N116BCN-EA1, CMN N140HCA-EEK, IVO M140NWFQ R5, IVO R140NWFW R0, BOE NT140*, BOE NV133FHM-N4F, AUO B140*, AUO B133HAN06.6 and AUO B116XTN02.3 eDP panels. - More implementation of AIE4 in amdxdna. - Update panels to use refcounts instead of devm_kzalloc to make drm_panel_init static. - Add support for the RCade Display Adapter to gud. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/98788814-e462-4950-bb2a-ea493c30d0c0@linux.intel.com
2026-05-15drm/bridge/rockchip: fix build after atomic API change.Dave Airlie1-2/+2
Signed-off-by: Dave Airlie <airlied@redhat.com>
2026-05-14drm/xe: Make drm_driver constMichal Wajdeczko1-3/+3
After removing runtime modification to our drm_driver definitions, we can make them const as they should be. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260512183342.3374-8-michal.wajdeczko@intel.com
2026-05-14drm/xe/display: Drop xe_display_driver_set_hooks()Michal Wajdeczko3-20/+1
This function is now no-op. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260512183342.3374-7-michal.wajdeczko@intel.com
2026-05-14drm/xe/display: Add macro with display driver featuresMichal Wajdeczko3-3/+5
Instead of updating drm_driver.driver_features in the runtime, we can use macro which value depends on the CONFIG_DRM_XE_DISPLAY. And if display support is later disabled by the xe_modparam then we will clear related bits in the drm_device.driver_features instead. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260512183342.3374-6-michal.wajdeczko@intel.com
2026-05-14drm/xe/display: Add macro with display driver opsMichal Wajdeczko3-4/+21
Instead of updating the drm_driver.fbdev_probe field in the runtime, we can use macro which value depends on the actual Kconfig setup. The .fbdev_probe hook will not be used by the drm core unless we also enable a DRIVER_MODESET driver feature flag, and this flag still depends on the xe_modparam.probe_display parameter. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: Jani Nikula <jani.nikula@intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260512183342.3374-5-michal.wajdeczko@intel.com
2026-05-14drm/xe/display: Prefer forward declarationsMichal Wajdeczko2-1/+4
There is no need to include xe_device.h in the xe_display.h header. Include it in the xe_display.c file instead. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260512183342.3374-4-michal.wajdeczko@intel.com
2026-05-14drm/xe/display: Drop xe_display_driver_remove() stubMichal Wajdeczko1-1/+0
The function was removed by commit d41d048043c4 ("drm/xe/display: Drop xe_display_driver_remove()") but we missed to remove its stub. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260512183342.3374-3-michal.wajdeczko@intel.com
2026-05-14drm/xe: Drop unused drm/drm_atomic_helper.h includeMichal Wajdeczko1-1/+0
We don't need this header in xe_device.c file. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260512183342.3374-2-michal.wajdeczko@intel.com
2026-05-14drm/xe/sriov: Mark NVL as SR-IOV capableJakub Kolakowski1-0/+2
Enable SR-IOV support for NVL platforms. Signed-off-by: Jakub Kolakowski <jakub1.kolakowski@intel.com> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: Piotr Piórkowski <piotr.piorkowski@intel.com> Cc: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com> Cc: Matt Roper <matthew.d.roper@intel.com> Reviewed-by: Tomasz Lis <tomasz.lis@intel.com> Link: https://patch.msgid.link/20260331152259.58270-1-jakub1.kolakowski@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-05-14drm: Suppress intentional warning backtraces in scaling unit testsGuenter Roeck1-6/+40
The drm_test_rect_calc_hscale and drm_test_rect_calc_vscale unit tests intentionally trigger warning backtraces by providing bad parameters to the tested functions. What is tested is the return value, not the existence of a warning backtrace. Suppress the backtraces to avoid clogging the kernel log and distraction from real problems. Additionally, the suppression API allows to actually ensure a warning was triggered, without parsing any kernel logs and keeping them clean. The suppression check requires CONFIG_BUG enabled. Link: https://lore.kernel.org/r/20260514-kunit_add_support-v11-3-b36a530a6d8f@redhat.com Tested-by: Linux Kernel Functional Testing <lkft@linaro.org> Acked-by: Dan Carpenter <dan.carpenter@linaro.org> Acked-by: Maíra Canal <mcanal@igalia.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: David Airlie <airlied@gmail.com> Cc: Daniel Vetter <daniel@ffwll.ch> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Alessandro Carminati <acarmina@redhat.com> Acked-by: David Gow <david@davidgow.net> Signed-off-by: Albert Esteve <aesteve@redhat.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-05-14drm/xe/gt_idle: Use NSEC_PER_MSEC instead of float literalShuicheng Lin1-1/+3
The residency multiplier conversion in get_residency_ms() used the floating-point literal 1e6 as the divisor of mul_u64_u32_div(). While the compiler constant-folds this to an integer, using float literals in kernel code is bad practice since the kernel generally avoids floating-point operations. Replace 1e6 with the standard NSEC_PER_MSEC macro from <linux/time64.h>, which is both self-documenting (ns to ms conversion) and unambiguously integer. Add the corresponding include rather than relying on transitive inclusion. No functional change. Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Nitin Gote <nitin.r.gote@intel.com> Link: https://patch.msgid.link/20260511153307.223435-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-05-14drm/xe/gsc: Fix double-free of managed BO in error pathShuicheng Lin1-4/+1
The error path in xe_gsc_init_post_hwconfig() explicitly frees a BO allocated with xe_managed_bo_create_pin_map() via xe_bo_unpin_map_no_vm(). Since the managed BO already has a devm cleanup action registered, this causes a double-free when devm unwinds during probe failure. Remove the explicit free and let devm handle it, consistent with all other xe_managed_bo_create_pin_map() callers. Fixes: 2e5d47fe7839 ("drm/xe/uc: Use managed bo for HuC and GSC objects") Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Assisted-by: Claude:claude-opus-4.6 Link: https://patch.msgid.link/20260511154134.223696-1-shuicheng.lin@intel.com Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
2026-05-14drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failureThomas Hellström1-8/+3
Apply the same fix as b2ed01e7ad ("drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure") to the ttm_bo_shrink() path. Move del_bulk_move from before the backup to after success only, using ttm_resource_del_bulk_move_unevictable() since the resource is now unevictable once fully backed up. Fixes: 70d645deac98 ("drm/ttm: Add helpers for shrinking") Cc: Christian König <christian.koenig@amd.com> Cc: Huang Rui <ray.huang@amd.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: Dave Airlie <airlied@redhat.com> Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v6.15+ Assisted-by: GitHub_Copilot:claude-opus-4.6 Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260511162443.24352-1-thomas.hellstrom@linux.intel.com Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-05-14drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPCThomas Hellström2-2/+5
dmem_cgroup_try_charge() returns -EAGAIN when the cgroup limit is hit and the charge fails. TTM has no concept of -EAGAIN from resource allocation; -ENOSPC is the canonical error meaning "no space, try eviction". Convert at the source in ttm_resource_alloc() so no caller needs to handle an unexpected error code, and clean up the now-redundant -EAGAIN check in ttm_bo_alloc_resource(). Without this, -EAGAIN escaping ttm_resource_alloc() during an eviction walk causes the walk to terminate early instead of continuing to the next candidate. Cc: Friedrich Vock <friedrich.vock@gmx.de> Cc: Maarten Lankhorst <dev@lankhorst.se> Cc: Tejun Heo <tj@kernel.org> Cc: Maxime Ripard <mripard@kernel.org> Cc: Christian Koenig <christian.koenig@amd.com> Cc: dri-devel@lists.freedesktop.org Cc: <stable@vger.kernel.org> # v6.14+ Fixes: 2b624a2c1865 ("drm/ttm: Handle cgroup based eviction in TTM") Assisted-by: GitHub_Copilot:claude-sonnet-4.6 Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Maarten Lankhorst <dev@lankhrost.se> Link: https://patch.msgid.link/20260508160920.230339-1-thomas.hellstrom@linux.intel.com
2026-05-14Merge tag 'amd-drm-fixes-7.1-2026-05-13' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixesDave Airlie7-211/+218
amd-drm-fixes-7.1-2026-05-13: amdgpu: - Userq fixes - DCN 3.2 fix - RAS fix - GC 12 fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260513224053.40670-1-alexander.deucher@amd.com
2026-05-13drm/hyperv: During panic do VMBus unload after frame buffer is flushedMichael Kelley2-7/+13
In a VM, Linux panic information (reason for the panic, stack trace, etc.) may be written to a serial console and/or a virtual frame buffer for a graphics console. The latter may need to be flushed back to the host hypervisor for display. The current Hyper-V DRM driver for the frame buffer does the flushing *after* the VMBus connection has been unloaded, such that panic messages are not displayed on the graphics console. A user with a Hyper-V graphics console is left with just a hung empty screen after a panic. The enhanced control that DRM provides over the panic display in the graphics console is similarly non-functional. Commit 3671f3777758 ("drm/hyperv: Add support for drm_panic") added the Hyper-V DRM driver support to flush the virtual frame buffer. It provided necessary functionality but did not handle the sequencing problem with VMBus unload. Fix the full problem by using VMBus functions to suppress the VMBus unload that is normally done by the VMBus driver in the panic path. Then after the frame buffer has been flushed, do the VMBus unload so that a kdump kernel can start cleanly. As expected, CONFIG_DRM_PANIC must be selected for these changes to have effect. As a side benefit, the enhanced features of the DRM panic path are also functional. Fixes: 3671f3777758 ("drm/hyperv: Add support for drm_panic") Signed-off-by: Michael Kelley <mhklinux@outlook.com> Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com> Signed-off-by: Wei Liu <wei.liu@kernel.org>
2026-05-14drm/virtio: Extend blob UAPI with deferred-mapping hintingDmitry Osipenko3-5/+28
If userspace never maps GEM object, then BO wastes hostmem space because VirtIO-GPU driver maps VRAM BO at the BO's creating time. Make mappings on-demand by adding new RESOURCE_CREATE_BLOB IOCTL/UAPI hinting flag telling that host mapping should be deferred until first mapping is made when the flag is set by userspace. Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Reviewed-by: Rob Clark <robdclark@gmail.com> Link: https://patch.msgid.link/20260501000043.2483678-1-dmitry.osipenko@collabora.com
2026-05-13drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_tableChen Ni1-0/+2
Check the return value of kzalloc() to prevent a NULL pointer dereference on allocation failure. Fixes: 06cfbca0e1c6 ("drm/msm/a6xx: Share dependency vote table with GMU") Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/721342/ Message-ID: <20260428073558.1234238-1-nichen@iscas.ac.cn> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-05-13drm/msm: Fix iommu_map_sgtable() return value check and avoid WARNMikko Perttunen1-2/+3
Commit "iommu: return full error code from iommu_map_sg[_atomic]()" changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero. Store the return value in the appropriate type and in case of error, return it rather than WARNing. Fixes: ad8f36e4b6b1 ("iommu: return full error code from iommu_map_sg[_atomic]()") Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Patchwork: https://patchwork.freedesktop.org/patch/719685/ Message-ID: <20260421-iommu_map_sgtable-return-v1-3-fb484c07d2a1@nvidia.com> Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
2026-05-13drm/msm: Correct modparam descriptionRob Clark1-1/+1
Preemption is enabled for gen8 as well. Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Patchwork: https://patchwork.freedesktop.org/patch/719256/ Message-ID: <20260418150847.157246-1-robin.clark@oss.qualcomm.com>
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.