Pull drm updates from Dave Airlie:
"Highlights:
- core: a lot of atomic refactoring in progress, panic got split into
a core/helpers model
- amdgpu: enables HDMI 2.1 FRL and other good things finally, UAlink
over Ethernet support
- xe: has a bunch of CRI support, ras error for bad vram, memory
offlining support.
- msm: enables a bunch more GPUs.
Otherwise it's a the usual mountain of stuff all over the place.
Details:
rust:
- I/O tree shared with driver-core
- DMA tree shared with driver-core
- allow aux registration data closures to return covariant sub-fields
- Implement Send and Sync for MapleTree
- add pci resource flags and IORESOURCE_MEM_64
drm/rust:
- add dma_fence abstraction
- init DRM registrations and their data in place
- drop unused flags argument to registration
vgaarb:
- rework API to pass a private ptr instead of pci device
sound:
- adapt to omapdrm changes
gem:
- add callback for handle count going to 0
gpusvm:
- share one HMM fault and keep single mappings inline
pagemap:
- Prevent CPU stalls during unbounded pagemap teardown
dma-fence:
- fix docs
vga_switcheroo:
- disconnect from fbcon
- update fbcon from within fbdev emulation
atomic:
- move DRM from state reset callbacks to atomic_create_state
- remove drm_simple_encoder_init
panic:
- split into core and helpers
buddy:
- improve dirty tracking
clients:
- improve vmap handling
- fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko
display:
- export HDMI SCDC status data via debugfs
- rework SCDC for better HDMI 2.0 support
- dp/mst: improve DPCD compliance
edid:
- parse AMD VSDB
- parse ALLM/VRR capabilities
- support detecting panel size
log:
- add drm_warn_ratelimited
sched:
- cleanup interface
- add missing locking
- fix run-queue cleanup
- fix locking
sysfb:
- remove obsolete quirk for Lenovo D330
- fix panel orientation for non-native display modes
- drop drm_class_device_register
colorop:
- provide DRM_COLOR_OP_FIXED_MATRIX
bridge:
- analogix: Support eDP lane mapping
- ti-sn65dsi83: Support LVDS Channel B on SN65DSI84
- Select DRM_PANEL_BRIDGE for various drivers that require it
- add chrontel ch7218a support
panel:
- panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
- samsung-s6d16d0: Use mipi_dsi_*_multi() functions
- support Ilitek ILI7836A OLED plus DT bindings
- support Novatek NT36532 plus DT bindings
- convert several drivers to managed cleanup
- fix Kconfig selections
- edp:
- Add support for BOE NV140FHM-T0A
- Support CSOT MNE007QB1-1
- NV140WU2-M70
- ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization
- samsung: Share test-key helpers
- ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings
- simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE
DV215FHM-R01 plus DT bindings
- Refactor struct drm_panel to contain struct drm_bridge plus fallout
in various panel drivers
- Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium
RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO
B140HAN04.0, AUO 0x0db3, panels.
amdgpu:
- use AMD VSDB for freesync
- implement YUV-to-RGB with fixed-matrix colorop
- enable FRL for HDMI
- HDMI 2.1 freesync support
- HDMI 2.1 ALLM support
- HDMI 2.1 VRR support
- UALoE (UALink over Ethernet) support
- add syncobj_points to userq signal ioctl
- drop unused kunit tests
- NBIO/GC/MMHUB/SMU updates/fixes
- GPU spatial partitioning updates
- display kunit fixes
- userq fixes
- RGB quantization fixes
- DC RMCM refactor
- DP MST fixes
- USB4 fixes
- add new trace events
- Rework display instance handling
- stack frame size fixes for various compilers/configs
- VCN 4/5 reset fixes
- freesync updates
- cursor refactor
- Fix direct scanout alpha on some DRM_FORMATs
- Expand Mac reserved memory workaround
- Make runtime pm more fine grained
amdkfd:
- updates and fixes
- GC 10 CU occupancy support
radeon:
- eDP fix for DCE3.2 iMacs
xe:
- add drm_ras netlink error event support
- add memory page offlining support
- introduce error threshold to drm_ras
- fix stale GTT mappings on unmap
- reject page faults for non-page fault mode scratch VM
- enable CRI package and VRAM temperatures
- introduce cold reset recovery
- handle CRI+ power interval encoding
- VF migration for multi-queue
- handle exec queue teardown after hot unplug
- alerts and controller enabling modifications
- use IBCv3 on PTL
- VRAM health check
- report GT TDR and VM rebind faults using SIGID
- add multi_queue_active_lrca debugfs
- shrinker: Runtime PM reference for non-system memory
- guc: Add simple KLV decoder helpers
- debugfs: Expose per-engine idle status
- Keep walking on SVM eviction failure
- Nuke PTs only after unlinking contested VMAs
- limit sg segment size to PAGE_SIZE on Xen PV
- keep VF LMEM bar size low if no VFs
- CPU binds and ULLS on migration queue
- New PTL PCI ID
- Enable PXP for NVL-S
- Do not dma_fence_put zero fences in err_out path
- Refresh TTM LRU on SVM prefetch
- export device UID in sysfs
i915:
- rename GEN6_PCODE_DATA to match spec
- fix incorrect RCU teardown order
- fix potential UAF in command parsing
- avoid WARN splat during RPS boosting race
- use simpler min functions
- Fixes to make i915 work well with PREEMPT_RT
i915/display:
- Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path
- Switch DG2 MPLL to DPLL framework
- DP-HDMI PCON DSC fixes
- limit invalid joiner combinations
- CDCLK related fixes and refactor around PCODE integration
- Gate UHBR SST SDP splitting on sink caps
- add HDMI TMDS audio bandwidth check
- vswing/preemph override
- enable AS SDP Skip frames
- Handle negative configuration index on DP link caps for robustness
- Preparation for enabling SDR plane color pipeline
- An eDP quirk for HP Pavilion Plus
- Introduce PME (Power Management Event) support on display hotplug
- Handle VSC SDP revision 7 in unpack
msm:
- CI:
- Dropped sc7180 trogdor lazor from the CI
- Core:
- Fixed msm_ioremap for resources without a name
- Changed msm.separate_gpu_kms to default to auto selection
- GPU:
- Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding
limits on CX/GX rails
- New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85
(Mahua)
- Fix VBIF halt mask on a306, which was preventing runpm suspend
- Enable THP support for GEM buffers
- Add modparam to disable waiting on fences in shrinker
- Drop use of drm_prime_sg_to_page_array()
- a5xx: don't read the GPMU registers on GPUs without a GPMU
- a2xx/a3xx/a5xx: hangcheck progress detection
- a6xx: gmuwrapper runpm fix
- Calculate reported GMEM size based on active slices
- Split a6xx/a7xx/a8xx catalog
- DP:
- Picked up some preparation patches for the MST support
- Fixed reported status of the link training
- DPU:
- Fixed CRTC bandwidth computation
- Fixed DSC programming
- Fixed encoder disablement path
- DSI:
- Fixed VM leak in error path
- Indention fix
- MDP5:
- Added MSM8952 configuration
- Dropped incorrect cursor pipe on MSM8976/56
- HDMI:
- Small fixes
nouveau:
- improve runtime PM on R570 GSP firmware
- various fixes throughout the driver
- dispnv50: support 2.147 GHz pixel clock in GB20x
nova:
- add initial uapi concept
- add initial PRAMIN access support
- add GpuMm centralized memory manager
- add GPU VM and BAR1 support
- add GPU interrupts and GSP events support
- GSP messaging fixes
tyr:
- use bitfield!
- zero unsupported and newly added GPU info fields
- limit doorbell array to 17 entries
exynos:
- FIMD fixes
- Fix clock leak on resume error path
- Fix Sparse warnings by adding missing __iomem annotation
- VIDI cleanup
- Replace kmalloc() and copy_from_user() with memdup_user()
amdxdna:
- fix BO handling
- Support AIE2 rev 9
- Fix UAF access in scheduler fences
- Update workqueue interface
- expose busy time via fdinfo
ast:
- support 256-byte EDID
hyperv_drm:
- remove support for pre win10 hosts
komeda:
- fix GLB_CORE_ID usage
omap:
- report HDMI hotplug events to ASoC HDMI codec
panthor:
- provide gpu_cache_flush tracepoint
- improve dma_fence signalling latency
- improve locking
- export scheduling information via debugfs
- Validate user-space input against firmware limits
qaic:
- reject BOs that exceed maximum page count
- add missing include statements
verisilicon:
- fix hardware cursor offsets
vkms:
- implement YUV-to-RGB with fixed-matrix colorop
gma500:
- avoid unsupported ARGB formats in primary plane
hibmc:
- handle vblank interrupts correctly
ivpu:
- add DRM_IVPU_CAP_CMDQ_SET_PRIORITY
- support command-queue priority ioctl
- Simplify NULL-pointer handling in cleanup code
arcpgu:
- replace simple-display pipeline with regular atomic helpers
aspeed:
- replace simple-display pipeline with regular atomic helpers
gm12u320:
- replace simple-display pipeline with regular atomic helpers
imagination:
- various improvement to firmware interaction
- add job to pvr_job_submit_fw trace event
mali-dp:
- fix runtime PM leak
mcde:
- replace simple-display pipeline with regular atomic helpers
p111:
- replace simple-display pipeline with regular atomic helpers
- drop unsupported alpha formats from primary plane
rcar-du:
- support Renesas R-Car V4H DSC
- dsi: Support larger transfers with AXI memory
- Support RZ/G3L SoC
repaper:
- replace simple-display pipeline with regular atomic helpers
rockchip:
- dsi: improve PHY timings
ssd130x:
- support Solomon SSD1351 OLED plus DT bindings
- ssd133x: upgrade color format to RGB565
- ssd132x: Set correct hardware window when clearing screen
tve200:
- replace simple-display pipeline with regular atomic helpers
xen:
- replace simple-display pipeline with regular atomic helpers
v3d:
- improve job handling under perfmon
vc4:
- reliably reset V3D
- drop brcm,vc4-v3d compatible
virtio:
- fix damage handling
- Support ARGB8888 for virtio primary planes.
host1x:
- Support partitioning
imx:
- Replace simple-display with regular atomic helpers
mxsfb:
- Support bus formats plus DT bindings
tegra:
- improve syncobj handling on submit
panfrost:
- add Mali-G68 support
- improve GPU reset handling
rockchip:
- add HDMI 2.0 support to dw-hdmi-qp
- improve HPD handling"
* tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel: (2324 commits)
drm/adp: Switch to drm_atomic_helper_connector_create_state
drm/malidp: Convert to atomic_create_state
drm/vc4: Switch to drm_atomic_helper_connector_create_state
drm/sysfb: Switch to drm_atomic_helper_connector_create_state
drm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_state
drm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_state
drm/hyperv: Switch to drm_atomic_helper_connector_create_state
drm/bridge: megachips: Switch to drm_atomic_helper_connector_create_state
drm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_state
drm/arm: komeda: Switch to drm_atomic_helper_connector_create_state
drm/appletbdrm: Fix incorrect error message on encoder attach failure
drm/sun4i: hdmi: Convert to drmm_connector_hdmi_init()
drm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilities
drm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilities
drm/bridge: ite-it66121: Advertise HDMI 1.2 capabilities
drm/bridge: ite-it6263: Advertise HDMI 1.3 capabilities
drm/bridge: ite-it6263: Drop redundant .mode_valid hook
drm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilities
drm/bridge: adv7511: Advertise HDMI 1.2 capabilities
drm/sched: Document entity->stopped is protected by entity->lock
...
Expose NPU device engine busy time through DRM fdinfo to enable
standardized userspace monitoring and profiling.
Add support for reporting per-engine busy time in nanoseconds via fdinfo
using the "drm-engine-npu" key. The value reflects the accumulated NPU
device execution time for a given process, allowing userspace tools to
observe NPU device utilization without driver-specific ioctls.
Signed-off-by: Max Zhen <max.zhen@amd.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20261012180808.2548697-1-max.zhen@amd.com
The buttress code that reads the tile fuse register is shared by all
generations, so the register field definition should not differ between
them. Extend the TILE_CONFIG mask from [6:1] to [7:1] and use it
everywhere, instead of having a different field width per generation.
The tile count range check in tile_disable_check() depended on the
previous field width. It only logs a warning, and it would now warn on a
valid value, so drop it together with the tile count defines it used.
Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20261012083802.2778448-6-karol.wachowski@linux.intel.com
Most registers in the 37xx and 40xx IP headers are the same, with only
the prefix differing, which forces a lot of code to be duplicated per
generation.
Merge them into ivpu_hw_ip_reg.h. Each register is defined once with the
prefix of the first generation that has it. New or changed fields use
the prefix of the generation that introduced them. The CPU_SS registers
that moved in 40xx are defined right below the 37xx ones. This leaves
some 37xx and 40xx code paths identical, which the next patch merges.
No functional change.
Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20261012083802.2778448-3-karol.wachowski@linux.intel.com
The buttress FREQ_CHANGE interrupt is not enabled by the driver, but
there is no way to turn it on for testing and debugging.
Store the buttress interrupt mask in struct ivpu_hw_info, so it is set up
once during HW info initialization instead of being a compile time
constant, and use it everywhere the mask is needed. Add the
IVPU_TEST_MODE_FREQ_CHANGE_ENABLE test mode that adds FREQ_CHANGE to this
mask.
No functional change with the test mode disabled.
Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20261012083802.2778448-2-karol.wachowski@linux.intel.com
Copy the API version array from the firmware image header into
struct ivpu_fw_info while the header is being parsed, and use the
cached copy afterwards. This way the raw firmware image header is only
accessed during image parsing, which is a step towards releasing the
firmware image once it has been loaded.
Since the API version is now available in vdev->fw before the
compatibility checks run, drop the redundant fw_hdr parameter from
IVPU_FW_CHECK_API_COMPAT(), IVPU_FW_CHECK_API_VER_LT() and the helpers
behind them, as well as from ivpu_fw_sched_mode_select().
Also make DRM_IVPU_PARAM_FW_API_VERSION read the cached copy instead of
dereferencing the firmware image directly.
No functional change.
Co-developed-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20261012080933.2771862-1-karol.wachowski@linux.intel.com
qaic_perf_stats_bo_ioctl() validates each BO by checking bo->sliced and
bo->dbc before returning its perf stats. These fields are changed by the
detach paths while holding bo->lock, but the perf stats ioctl reads them
without that lock.
A concurrent detach can clear bo->dbc and mark the BO unsliced while the
perf stats ioctl is validating the BO. Take bo->lock while checking the
BO state and copying the per-BO stats into the temporary result buffer.
Fixes: 4ddf4ddfce ("accel/qaic: Ensure entry belongs to DBC in qaic_perf_stats_bo_ioctl()")
Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://patch.msgid.link/6a115824.a0bed9bd.3c0137.9edf@mx.google.com
Sahara removal cancels fw_work and dump_work, but leaves read_data_work
pending or running. The latter accesses the firmware and the device-managed
context and transfer buffer, which are released during removal.
Cancel read_data_work after fw_work, which can schedule it, and before
releasing the firmware. The MHI core suspends and resets the channels
before invoking the driver's remove callback.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code. The same omission was also reported by the
Sashiko bot while reviewing the Sahara relocation series.
Fixes: 7fb19ea1ec ("accel/qaic: Support the new READ_DATA implementation")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260701105055.8D4371F00A3A@smtp.kernel.org/
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
[jhugo: reorder cancel_work_sync() calls]
Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://patch.msgid.link/20260917192512.56205-1-mhun512@gmail.com
sched_to_core() walks rdev->cores[] up to rdev->num_cores, and
rocket_remove() decrements num_cores for every core it removes. Unbind a
core that is not the last one and the cores behind it fall outside the
search, so sched_to_core() returns NULL for a core that is still bound and
still running jobs. Neither caller checks the result:
rocket_job_run(): rocket_fence_create(core), core->dev
rocket_job_timedout(): dev_err(core->dev, "NPU job timed out")
Unbinding the middle core of the three on an RK3588 while three clients are
submitting to all of them faults twice, once from the surviving core's
job queue and once from its reset work:
KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227]
Workqueue: fdad0000.npu drm_sched_run_job_work [gpu_sched]
pc : rocket_job_run+0x234/0x838 [rocket]
Call trace:
rocket_job_run+0x234/0x838 [rocket]
drm_sched_run_job_work+0x2cc/0xad8 [gpu_sched]
process_one_work+0x640/0x14f0
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Workqueue: rocket-reset-2 drm_sched_job_timedout [gpu_sched]
pc : rocket_job_timedout+0xf0/0x1e0 [rocket]
Call trace:
rocket_job_timedout+0xf0/0x1e0 [rocket]
drm_sched_job_timedout+0x188/0x6a0 [gpu_sched]
Both are the third core: the workqueue names are its device and its
core->index, and it was left at slot 2 while num_cores had dropped to 2.
Search all the slots that were allocated, the way find_core_for_dev() now
does. A core that is still bound is then found, and the two callers get
the pointer they already assume they have.
This does not make unbinding one core out of several safe. An open client
keeps an entity pointing at the scheduler of the core that went away:
drm_sched reports it as not ready for every job that lands on it, and the
client waits in dma_fence_default_wait for a fence that will never signal.
Stopping the NULL dereference is what belongs in a fix; the rest wants
more thought.
Reported-by: Sidong Yang <sidong.yang@furiosa.ai>
Closes: https://lore.kernel.org/dri-devel/apwUewaRnoTNXHCt@rock-5b-plus/
Fixes: 0810d5ad88 ("accel/rocket: Add job submission IOCTL")
Cc: stable@vger.kernel.org
Signed-off-by: Igor Paunovic <royalnet026@gmail.com>
Assisted-by: LLM sparse checkpatch
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20260905150432.7477-1-royalnet026@gmail.com
rocket_remove() decrements rdev->num_cores for each core it removes,
while find_core_for_dev() searches slots 0 to num_cores - 1. Unbinding
the cores in the order they were bound therefore loses the last one: by
the time it is removed the search range has already shrunk past its
slot, so find_core_for_dev() returns -1 and rocket_remove() gives up
without doing anything.
num_cores never reaches zero, rocket_device_fini() never runs, and the
file-scoped rdev keeps pointing at a device that is going away. Binding
the cores again starts from that stale count, because rocket_probe()
takes rdev->num_cores as the slot to fill. On an RK3588, which describes
three cores, the second round lands on slots 1, 2 and 3 while rdev->cores
was allocated with room for three:
rocket fdab0000.npu: Rockchip NPU core 1 version: 1179210309
rocket fdac0000.npu: Rockchip NPU core 2 version: 1179210309
rocket fdad0000.npu: Rockchip NPU core 3 version: 1179210309
The write to rdev->cores[3] is past the end of the array.
Nothing in tree reads the core array often enough to notice, so the
overrun is silent today. It turned up while testing a devfreq series on
top of this, where a worker walks every core a few times a second, and
UBSAN caught the first bool it read out of the overrun entry:
UBSAN: invalid-load in drivers/accel/rocket/rocket_devfreq.c:47:10
load of value 5 is not a valid value for type '_Bool'
Workqueue: devfreq_wq devfreq_monitor
Record how many slots were allocated and search all of them. Every core
is then found on removal, num_cores reaches zero, the device is torn down
and a later bind starts from a clean rdev.
This does not make unbinding a single core out of several work. probe
still takes num_cores as the slot to fill, so rebinding one core while
its siblings stay bound would write over a slot that is already in use,
and rocket_open() still reaches for cores[0] whether or not anything is
there. Both of those want more thought than a fix should carry.
Found by unbinding and rebinding all three cores on an Orange Pi 5 Plus.
With this applied, 25 unbind/rebind rounds and 5 module unload/reload
rounds run clean there: the cores land in slots 0, 1 and 2 every time,
whichever order they are bound in, and the shared supply goes back to a
single user after each round.
Fixes: ed98261b41 ("accel/rocket: Add a new driver for Rockchip's NPU")
Cc: stable@vger.kernel.org
Signed-off-by: Igor Paunovic <royalnet026@gmail.com>
Assisted-by: LLM sparse checkpatch
Tested-by: Jiaxing Hu <gahing@gahingwoo.com> # RK3576, two cores
Tested-by: Sidong Yang <sidong.yang@furiosa.ai> # RK3588, 3 cores
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20260904125936.26234-1-royalnet026@gmail.com
rocket_probe() stores the return value from rocket_device_init() in the
file-scoped rdev pointer before checking whether it is an error pointer.
If rocket_device_init() fails, rdev is left as an ERR_PTR.
The rdev pointer is also used as the marker for whether the shared rocket
device has already been initialized. A later core probe can therefore see
a non-NULL rdev, skip rocket_device_init(), and dereference the error
pointer when reading rdev->num_cores.
Save the error code and clear rdev before returning from the
rocket_device_init() failure path.
Fixes: ed98261b41 ("accel/rocket: Add a new driver for Rockchip's NPU")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Igor Paunovic <royalnet026@gmail.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20260708062845.716487-1-lgs201920130244@gmail.com
The regcmd fields in drm_rocket_task come from userspace and are
programmed into the PC unit without any validation.
Bits 31:4 of PC_BASE_ADDRESS hold the register command DMA address
and bit 0 selects slave mode, so a misaligned regcmd silently drops
its low bits, and an odd address flips the PC unit into slave mode.
Similarly, pc_data_amount is a 16-bit field holding
(regcmd_count + 1) / 2 - 1, so a larger regcmd_count is silently
truncated by the register encoding.
Reject unaligned regcmd addresses and out-of-range regcmd_count with
-EINVAL at submission time. Existing userspace is not affected: Mesa
places regcmd buffers at 64-byte aligned offsets, and its regcmd
counts stay far below the limit.
Signed-off-by: Sidong Yang <sidong.yang@furiosa.ai>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20261004164727.466164-4-sidong.yang@furiosa.ai
NPU3 devices do not set dev_mem_size, since they do not use a device
heap. Creating an AMDXDNA_BO_DEV_HEAP BO on such a device hits the
WARN_ON(!is_power_of_2(dev_mem_size)) check, which any user with
access to the device node can trigger.
Return -EOPNOTSUPP when dev_mem_size is 0.
Fixes: d76856beb4 ("accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval")
Signed-off-by: David Zhang <yidong.zhang@amd.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20261008232416.2646054-1-yidong.zhang@amd.com
The amdxdna has a soft dependency on the amd_pmf module. It will use an
exported function if it is available and fall back to another function
if it is not enabled.
amdxdna and amd_pmf are tridstate modules supporting both built [y] and
modularized [m] in the .config file. Since the amdxdna decides to use
the amd_pmf if it is either a module or built in (see
drivers/accel/amdxdna/aie2_pci.h), then there is an issue if they are
not compiled either both as modules or both as built-in.
Adding the optional dependency to Kconfig does not allow the
configuration from being selected.
Fixes: f66d6cc689 ("accel/amdxdna: Support sensors for column utilization")
Signed-off-by: Liam R. Howlett <liam@infradead.org>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20261009011010.3521631-1-liam@infradead.org
On 40XX and later the NPU does not treat address bits 42 and above as
part of the memory address, as the hardware uses them internally, but
ivpu sets a 48-bit DMA mask for these generations.
In practice the IOMMU capabilities already limit the DMA addresses to
42 bits, so this does not fix an observed problem. Set the DMA mask to
42 bits anyway, so the driver does not depend on the IOMMU
configuration to stay within the range the NPU can address. 37XX keeps
its 38-bit mask.
Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20261006093740.2304835-1-karol.wachowski@linux.intel.com
The mailbox ring buffer geometry comes from AMD signed firmware, through
the management or mailbox information block, or through the CREATE_CONTEXT
response, and the driver trusts it by design.
The power-of-two test on rb_size was a firmware debugging aid. Nothing in
the driver derives a mask, a shift or a modulo from rb_size, so no code
depends on the property it tested. The ring index wrap is handled by the
explicit comparisons in mailbox_send_msg() and mailbox_get_msg().
Replace the test with a comment that records the design, so that
automated review does not flag the absence of a bound here again.
Suggested-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://lore.kernel.org/all/67698952-6394-44a8-01fe-3e3558b7cb4c@amd.com/
Signed-off-by: Eva Crystal <0xiviel@gmail.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20261002205814.178031-1-0xiviel@gmail.com
Replace the per-message kzalloc() with a pre-allocated pool of N slots.
Each slot is rb_size bytes which is the combined size of the mailbox_msg
metadata and the package payload must not exceed rb_size. No dynamic
allocation is needed in the send hot path.
msg_id encodes the slot index as (slot | MAGIC_VAL), allowing O(1)
lookup on response. A bool busy field tracks slot occupancy; it is set
after the memset() that initialises the slot so the flag is not zeroed
out, and cleared in mailbox_msg_done() before invoking the callback so
the slot is available for reuse by the time the callback returns.
mailbox_msg_done() is introduced as a helper that saves the callback
pointer, clears busy via smp_store_release(), then invokes the callback.
The release barrier ensures the loads of notify_cb and handle complete
before busy is cleared. Without it, a concurrent sender could overwrite
those fields after observing busy == false. mailbox_acquire_msgid() uses
smp_load_acquire() on busy to pair with the release store. Callers hold
a per-channel mutex, so only one sender runs at a time and no atomic
slot claim is needed.
NULL notify_cb is handled inside mailbox_msg_done() so fire-and-forget
sends (e.g. aie2_config_cu with no callback) are correctly tracked as
in-flight until the response arrives.
The management channel slot count and async event pool size both use a
static AMDXDNA_MAX_ASYNC_EVENT_BUFS of 4. The channel must be
initialised before total_col is known from firmware, so the value
cannot be derived from ndev. Both counts must stay equal. The channel
is sized AMDXDNA_MAX_ASYNC_EVENT_BUFS + 1 (one extra for other
management commands), so the pool cannot exceed that.
Signed-off-by: Max Zhen <max.zhen@amd.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20261002161122.1350075-1-max.zhen@amd.com
ivpu_hw_ip_soc_cpu_boot() and pwr_island_delay_set() keep the result of
their per-generation switch in locals that are left uninitialized on the
path past the last case. Building with -Wmaybe-uninitialized reports ret,
post, post2 and status; Kbuild disables that warning for GCC, so it does
not show up in a normal build.
Let every case return directly instead, so no local is needed.
ivpu_hw_ip_soc_cpu_boot() now dispatches on its own, with the debug
message moved ahead of the switch so that the boot mode is logged before
the boot registers are written, and the power island delay values move
into per-generation helpers. Neither switch has a default: label, so
-Wswitch reports any enum vpu_hw_ip value added later that is not
handled, and the path past the switch returns -EINVAL.
Build the power island delay values from zero instead of reading the
registers first. POST_DLY, POST1_DLY and POST2_DLY together span every
writable bit of PWR_ISLAND_EN_POST_DLY, and STATUS_DLY spans every
writable bit of PWR_ISLAND_STATUS_DLY, so the read-modify-write only
fetched bits that are immediately overwritten.
The boot mode is now logged even when the boot fails; no other functional
changes.
Signed-off-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Reviewed-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20261001110401.2866557-4-dawid.osuchowski@linux.intel.com
Change the hw_ip_gen and btrs_gen members of struct ivpu_device, and
their accessors, from u32/int to enum vpu_hw_ip/enum vpu_hw_btrs, and
drop the default: labels from the switch statements in ivpu_hw_ip.c
that dispatch on them. Switching on the real enum types lets the
compiler treat these switches as exhaustive at compile time, so a
missing case for a new generation now warns instead of silently
hitting default:.
This compile-time guarantee holds because ivpu_ip_gen_init() now fails
probe on an unrecognized PCI device ID instead of leaving these fields
at 0, so the switches never see an unhandled value.
Signed-off-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Reviewed-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20261001110401.2866557-3-dawid.osuchowski@linux.intel.com
Remove the per-call switch in ivpu_hw_ip_gen()/ivpu_hw_btrs_gen() and
instead initialize the HW IP generation and buttress version once during
device init.
Fail probe with -EINVAL when the PCI device ID does not match any known
generation, instead of warning and continuing with both fields left at 0,
so callers never proceed with an unrecognized generation.
Drop hw->dma_bits and compute it locally to remove the early dependency
on vdev->hw_ip_gen.
Make pwr_island_delay_set() use ivpu_hw_ip_gen() instead of the PCI
device ID directly.
Move MODULE_DEVICE_TABLE() to the top of the file to colocate it with
the HW IP and buttress detection logic.
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Co-developed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Signed-off-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20261001110401.2866557-2-dawid.osuchowski@linux.intel.com
drm_timeout_abs_to_jiffies() began as a static helper inside the syncobj
wait implementation and was later exported in place, so that it could be
called by multiple drivers (e.g. panfrost, lima, tegra and accel
drivers). All of them reach it through drm_utils.h.
Give it a file of its own, so that timeout conversion helpers have a
home, which will be useful when we add new timeout handlers. Also create
a drm_timeout.h header to host all timeout-related helpers.
The function was moved to the new file as it is, including the use of
"signed long" as the return type. Note that the return and parameters
types should be reconsidered in the future to better represent the
non-negative nature of a timeout.
No functional change.
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patch.msgid.link/20260915-drm-timeout-helpers-v3-1-f2ae987d861f@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
create_singlethread_workqueue() is deprecated. Replace it with
alloc_ordered_workqueue() to use the shared system workqueue
infrastructure more efficiently.
WQ_MEM_RECLAIM is added to ensure the mailbox can process
interrupts under memory pressure.
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: George Karagounis <mail@taterr.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260925124804.58808-2-mail@taterr.org
The hardware context scheduler fence is exposed through
drm_syncobj_add_point(). After a hardware context is destroyed,
userspace can still call drm_sched_fence_get_timeline_name() on the
fence through SYNC_IOC_FILE_INFO. This results in a use-after-free
when accessing fence->sched->name.
Preallocate hardware context schedulers and free them during device
teardown instead. A destroyed hardware context no longer frees its
scheduler, ensuring that the scheduler remains valid while its fences
are still accessible.
Fixes: aac243092b ("accel/amdxdna: Add command execution")
Reported-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
Link: https://lore.kernel.org/dri-devel/20260902012712.880520-1-malhyuk97@gmail.com/
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260923200501.281208-1-lizhi.hou@amd.com
Backmerging drm/drm-next into drm-misc-next to get fixes from v7.3-rc4.
Required for commit 2ab510e631 ("drm/sched: Fix virtual runtime race").
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Linux 7.3-rc4
Requested by Philipp Stanner for
2ab510e631 would be needed as a groundlayer
for further patches that extend the locking in drm_sched
Signed-off-by: Dave Airlie <airlied@redhat.com>
amdxdna_drm_sync_bo_ioctl() calls amdxdna_hwctx_sync_debug_bo() for every
FROM_DEVICE sync, which answers -EINVAL when the BO's assigned_hwctx names
no context. Only a BO attached with ATTACH_DEBUG_BO is ever given one, so
an ordinary read-back sync reports failure after its flush has already run.
Ask for the debug sync only when the BO has a context. An unattached BO
carries AMDXDNA_INVALID_CTX_HANDLE and hwctx ids are allocated above it, so
the test is exact, -EINVAL keeps meaning that the named context is gone,
and the handle is not resolved twice. The field is written under dev_lock
and read here without it; the context is still resolved under that lock, so
a racing attach only decides whether this sync sees the buffer.
Fixes: 7ea0468380 ("accel/amdxdna: Support firmware debug buffer")
Suggested-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Taimuraz Kaitmazov <taimuraz@kaitmazov.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260819224458.257346-6-taimuraz@kaitmazov.com
amdxdna_drm_sync_bo_ioctl() answers a failed amdxdna_flush_bo() with
drm_WARN(). Both of that function's error returns are decided by the
ioctl's arguments, so SYNC_BO with an offset past the end of the BO
splats and taints the kernel from an unprivileged caller.
Log it at debug level, since the same caller can repeat it.
Fixes: dbc8fd7a03 ("accel/amdxdna: Add expandable device heap support")
Signed-off-by: Taimuraz Kaitmazov <taimuraz@kaitmazov.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260819224458.257346-4-taimuraz@kaitmazov.com
aie2_create_context() allocates a mailbox channel, starts it, and on a
failed start frees it again:
hwctx->priv->mbox_chann = xdna_mailbox_alloc_channel(ndev->mbox);
...
ret = xdna_mailbox_start_channel(hwctx->priv->mbox_chann, ...);
if (ret)
goto free_channel;
...
free_channel:
xdna_mailbox_free_channel(hwctx->priv->mbox_chann);
hwctx->priv->mbox_chann keeps pointing at the freed channel. That
pointer is the driver's own test for whether a hardware context has a
usable channel: aie2_destroy_context() returns early on NULL,
aie2_sched_job_run() refuses to run a job on NULL, and the message
helpers return -ENODEV on NULL. A stale pointer passes all of them.
It matters on the restart path. aie2_hwctx_restart() calls
aie2_create_context() again on a hardware context that is already live,
after aie2_hwctx_stop() has torn its channel down, and the context
survives a failure there: aie2_sched_job_timedout() discards the return
value entirely, and aie2_hwctx_resume() only propagates it. What is
left is a live hardware context holding a freed channel, and every
later user of it takes the non-NULL branch:
- the next job submitted reaches xdna_mailbox_send_msg() on the freed
channel, via the !mbox_chann guard in aie2_sched_job_run(),
- a second command timeout reaches aie2_hwctx_stop() ->
aie2_destroy_context(),
- closing the device reaches aie2_hwctx_fini() ->
aie2_release_resource() -> xrs_release_resource() ->
aie2_xrs_unload() -> aie2_destroy_context(),
and aie2_destroy_context() then calls xdna_mailbox_stop_channel()
followed by xdna_mailbox_free_channel() on memory that was already
freed: a use-after-free, and a second free of the same channel.
The AIE4 management channel already does this correctly -
aie4_mailbox_start() clears ndev->aie.mgmt_chann right after freeing
it. Do the same here.
The create path itself is not affected: when aie2_xrs_load() fails,
xrs_allocate_resource() removes the solver node without calling
->unload, and aie2_hwctx_init() frees hwctx->priv, so the stale pointer
never outlives the structure holding it.
Starting a channel can fail today without this patch: the ring buffer
sizes firmware reports are rejected unless both are powers of two, and
request_irq() can fail.
Fixes: d5b8b0347f ("accel/amdxdna: Split mailbox channel create function")
Cc: stable@vger.kernel.org
Signed-off-by: Eva Crystal <0xiviel@gmail.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/2fcf0eca215090dbbd95cb86e1bf5076056d3818.1789334558.git.0xiviel@gmail.com
When aie2_populate_range() faults in pages, it only sets
HMM_PFN_REQ_FAULT. Without HMM_PFN_REQ_WRITE, handle_mm_fault() does not
request write permissions and may populate the CPU page tables with
read-only PTEs.
Check the VMA flags and set HMM_PFN_REQ_WRITE when the VMA has VM_WRITE.
Fixes: e486147c91 ("accel/amdxdna: Add BO import and export")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260917171952.1883974-1-lizhi.hou@amd.com
A userspace process can concurrently trigger an unmap, which queues
hmm_unreg_work, and free BO. If amdxdna_hmm_unreg_work() executes
list_del(&mapp->node) and is preempted before calling amdxdna_umap_put(),
amdxdna_hmm_unregister_all() can fail to find the mapping in the list
and return without calling cancel_work_sync(). This allows object
destruction to proceed while the worker still holds a pointer to the BO
in the umap structure.
Moving the work item from struct amdxdna_umap to struct amdxdna_gem_obj.
The worker no longer holds a pointer to an individual mapping, so there
is no longer a window where the umap has been unlinked from umap_list but
work is still pending against it. The work item now lives in the BO
itself, so use a single cancel_work_sync() in the free path to drain the
work.
Fixes: 445d209104 ("accel/amdxdna: Fix unexpected wait when flushing notifier_wq")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260917154824.1872220-1-lizhi.hou@amd.com
The map structure is currently only partially initialized when the
notifier is registered. Although holding mmap_write_lock() prevents
the notifier callback from running before the remaining initialization
is complete, the ordering can be confusing during code review.
Fully initialize the map structure before registering the notifier so
that the structure is completely constructed before it is published.
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260911163907.1193852-1-lizhi.hou@amd.com
Use the vdev->timeout structure for register poll timeouts. This allows
adjusting those timeouts depending on the platform type.
For FPGA set MMU timeouts to 10x.
Register poll timeouts are expressed in microseconds and are passed to
read_poll_timeout(), which disables a timeout when it is 0, unlike the
millisecond timeouts that are disabled with a negative value.
Also initialize state_dump_msg in the IVPU_TEST_MODE_DISABLE_TIMEOUTS
branch, which was missed when the field was added. Unlike the other
fields, it is a fixed delay passed to msleep() rather than a timeout, so
it has to keep a finite value. It is only reachable with this debug test
mode enabled, so there is no need for backporting.
Signed-off-by: Tomasz Rusinowicz <tomasz.rusinowicz@intel.com>
Reviewed-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20260915083651.950890-1-karol.wachowski@linux.intel.com
handle_mm_fault() must not be called from the mmap callback because
the VMA has not yet been linked. The handle_mm_fault() API contract
assumes that the VMA is already linked.
Remove the handle_mm_fault() call from the mmap callback. For imported
BOs, mark the mapping as invalid and rely on the first command submission
to fault in the pages.
For shmem BOs, set the VM_MIXEDMAP flag and use vm_insert_pages().
Implement amdxdna_gem_mixed_vm_ops to handle the page faults.
Fixes: e486147c91 ("accel/amdxdna: Add BO import and export")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260910211338.1102315-1-lizhi.hou@amd.com
In amdxdna_gem_obj_open(), abo->lock is held when calling
amdxdna_gem_add_bo_usage(), which then acquires client->mm_lock.
However, the heap update path may acquire these locks in the reverse
order, creating a potential deadlock.
Fix this by saving the client pointer locally before acquiring abo->lock,
and releasing abo->lock before calling amdxdna_gem_add_bo_usage().
Apply the same change to amdxdna_gem_obj_close().
Fixes: 1f513a3ec3 ("accel/amdxdna: Add per-process BO memory usage query support")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260902180955.3999242-2-lizhi.hou@amd.com
Accessing abo->client in amdxdna_gem_del_bo_usage() may result in a
use-after-free when the BO is imported via flink.
Disable flink import by verifying that filp->driver_priv matches the client
stored in abo->client before accessing the client.
Fixes: 3cc5d7a595 ("accel/amdxdna: Add carveout memory support for non-IOMMU systems")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260902180955.3999242-1-lizhi.hou@amd.com
Add a new DRM_IVPU_PARAM_CMDQ_PRIORITY parameter to query and update
the scheduling priority of an existing command queue, identified by
its ID via drm_ivpu_param.index.
The priority can be changed on a queue that already has pending jobs;
if the queue's doorbell is registered, the new priority is propagated
to the firmware immediately, otherwise it is applied when the queue is
next registered. The firmware picks up the change at the first
opportunity.
The feature requires HW scheduling mode and is advertised through the
new DRM_IVPU_CAP_CMDQ_SET_PRIORITY capability. Legacy command queues
are not supported.
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20260831121617.395523-1-andrzej.kacprowski@linux.intel.com
Linus Torvalds