David Francis [Thu, 25 Jun 2026 14:09:13 +0000 (10:09 -0400)]
drm/amdkfd: Use kvcalloc to allocate arrays
There were a few instances in kfd_chardev.c of kvzalloc being
used to allocate memory for an array.
Switch those to kvcalloc, which
- is the standard way of allocating a zero-initialized array
- does a check for the mul overflowing
Signed-off-by: David Francis <David.Francis@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com> Reviewed-by: Kent Russell <kent.russell@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Geoffrey McRae [Wed, 24 Jun 2026 02:34:06 +0000 (12:34 +1000)]
drm/amdkfd: use amdgpu ring types for MES queue
The MES interface takes queue types as enum amdgpu_ring_type values.
The MES backend is responsible for converting those values to
firmware-facing MES_QUEUE_TYPE values when building MES packets.
The KFD queue manager was converting KFD queue types directly to
MES_QUEUE_TYPE values before filling the MES input structures. That is
the wrong abstraction level for the generic MES interface.
Change the KFD helper to return AMDGPU_RING_TYPE_* values and rename it
to make the expected type explicit. Use the helper for the add, remove,
and reset MES paths.
Geoffrey McRae [Wed, 24 Jun 2026 02:32:18 +0000 (12:32 +1000)]
drm/amdgpu,amdkfd: correct setting MES queue type
MES ADD_QUEUE programs the firmware with the queue type from the driver
input, but MES REMOVE_QUEUE leaves queue_type at the zero-initialized
value. Zero decodes as GFX in the MES REMOVE_QUEUE packet.
That means removing a KFD compute queue can be submitted to MES as a GFX
queue. In a debug-trap suspend/remove sequence this can leave MES
looking for the doorbell in the wrong queue class and the REMOVE_QUEUE
command may never complete. The observed failing packet removed
doorbell 0x1002 with queue_type=GFX even though the corresponding
ADD_QUEUE for the same doorbell was queue_type=COMPUTE.
Populate REMOVE_QUEUE.queue_type the same way ADD_QUEUE does.
Amber Lin [Fri, 26 Jun 2026 03:09:10 +0000 (23:09 -0400)]
drm/amdgpu: Fix false error return to non-KCQ
amdgpu_gfx_reset_mes_compute is used to coordinate suspend_all, reset,
and resume_all between KCQ and compute user queues. When a hung queue
comes from the compute user queues and the reset is successful, the KCQ
failure after reset should be sent to KCQ only and not the compute user
queues. Compute user queues can operate after a successful reset without
a mode reset.
Fixes: a4e4d945cba8 ("drm/amdgpu/gfx: defer per-queue helper_end until after MES resume") Signed-off-by: Amber Lin <amber.lin@amd.com> Acked-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
WenTao Liang [Fri, 26 Jun 2026 12:45:55 +0000 (20:45 +0800)]
drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference
prev_sink is unconditionally retained via dc_sink_retain at function
entry, but the DP alt mode timeout path inside SIGNAL_TYPE_DISPLAY_PORT
returns false without releasing prev_sink. All other return paths in the
function correctly call dc_sink_release(prev_sink), making this the only
missing cleanup.
Fixes: 54618888d1ea ("drm/amd/display: break down dc_link.c") Signed-off-by: WenTao Liang <vulab@iscas.ac.cn> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260626124555.36910-1-vulab@iscas.ac.cn Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Timur Kristóf [Wed, 24 Jun 2026 07:38:28 +0000 (09:38 +0200)]
drm/amdgpu: Simplify filtering rings during IP block soft reset
Instead of storing pointers to affected rings in an array,
just iterate over all rings of the device and filter the
affected rings by type using the type mask.
This is done to save memory used by the array of affected
rings which was sized AMDGPU_MAX_RINGS.
Suggested-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Reviewed-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> # for the series Link: https://patch.msgid.link/20260624073829.40835-1-timur.kristof@gmail.com Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Eric Huang [Wed, 17 Jun 2026 18:42:48 +0000 (14:42 -0400)]
drm/amdkfd: add sanity check in svm_range_is_valid
to prevent svm range to be overflow or underflow.
Signed-off-by: Eric Huang <jinhuieric.huang@amd.com> Reviewed-by: Philip Yang <philip.yang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stanley.Yang [Fri, 26 Jun 2026 06:04:53 +0000 (14:04 +0800)]
drm/amdgpu/ras: Resum RAS IP hw init during nps dynamic switch
On an XGMI reset-on-init (NPS memory patition mode switch), RAS
IP hw fini, sw fini is called but hw init is skipped due to
RAS IP block is not included in hwinit mask, so need call
RAS IP hw init during XGMI reset-on-init.
Alex Hung [Tue, 23 Jun 2026 03:11:18 +0000 (21:11 -0600)]
drm/amd/amdgpu: Fix stack frame size warnings in KUnit tests
[WHAT]
Replace stack-allocated large structs with kunit_kzalloc() in KUnit
test functions that exceed the kernel 1280-byte stack frame limit.
Also add CONFIG_FRAME_WARN=1024 to .kunitconfig to enforce the limit.
Affected structs and files:
- struct dc_link in amdgpu_dm_connector_test.c and
amdgpu_dm_mst_types_test.c
- struct drm_plane, drm_plane_state, drm_framebuffer in
amdgpu_dm_plane_test.c
- struct drm_connector_state, drm_atomic_state in
amdgpu_dm_mst_types_test.c
- struct dm_connector_state in amdgpu_dm_test.c
Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202606230825.9qMV9L0g-lkp@intel.com/ Assisted-by: Copilot:Claude-Opus-4.6 Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Charlene Liu <charlene.liu@amd.com> Signed-off-by: Leo Chen <leo.chen@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Andrew Lichmanov [Fri, 19 Jun 2026 19:04:15 +0000 (15:04 -0400)]
drm/amd/display: Disable mem gating for DCHVM on DCHVM init
[Why] Hang occurs with global gating enabled if req=1
Reviewed-by: Leo Chen <leo.chen@amd.com> Signed-off-by: Andrew Lichmanov <Andrew.Lichmanov@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Alex Hung [Thu, 18 Jun 2026 20:22:27 +0000 (14:22 -0600)]
drm/amd/display: Extract shared KUnit test helpers
Extract common allocation and setup patterns from KUnit test
files into a dedicated helpers module to reduce duplication.
Add tests/amdgpu_dm_kunit_helpers.c with shared helpers:
- dm_kunit_alloc_adev: allocate amdgpu_device via DRM mock
- dm_kunit_alloc_link: allocate zeroed dc_link
- dm_kunit_alloc_link_with_ctx: allocate dc_link with dc_context
- dm_kunit_alloc_dm: allocate display_manager with DC state
- dm_kunit_alloc_stream: allocate dc_stream_state with link
- dm_kunit_add_stream_to_state: wire stream into dc_state
- dm_kunit_alloc_connector: allocate connector wired to device
Update 10 test files to use the shared helpers, removing
duplicated local alloc_test_adev, alloc_test_link,
alloc_test_dm, alloc_test_stream, and add_test_stream
functions.
Add missing MODULE_DESCRIPTION() macro to suppress modpost warning:
WARNING: modpost: missing MODULE_DESCRIPTION() in
amdgpu_dm_kunit_helpers.o
Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Harry Wentland [Wed, 17 Jun 2026 19:00:40 +0000 (15:00 -0400)]
drm/amd/display: hold a vblank ref while writeback is pending
Writeback completion is detected in dm_crtc_high_irq(), the CRTC vblank
IRQ handler. The arm path (dm_set_writeback) never took a vblank
reference, so the interrupt was only enabled incidentally (by a pageflip
on the same commit, fbcon, or a previous vblank's off-delay window).
A writeback-only commit right after a fresh drm_crtc_vblank_on() (e.g. a
writeback connector detached and re-attached) therefore has no vblank
reference: the IRQ never fires, wb_pending is never cleared and the out
fence times out. This is reproducible with IGT kms_writeback and was
seen via kms_colorop on writeback-capable hardware. The relevant IGT
branch is at
https://gitlab.freedesktop.org/hwentland/igt-gpu-tools/-/tree/yuv-fm-colorop
Take a vblank reference when arming the writeback and release it once
completion is signalled. The get is done before arming wb_pending so the
completion IRQ cannot drop the reference before it is taken. Factor the
shared completion bookkeeping into amdgpu_dm_crtc_complete_writeback()
and also call it from the teardown path, so a writeback torn down while
still pending signals its out fence and releases the reference instead of
leaking both.
Fixes: c81e13b929df ("drm/amd/display: Hande writeback request from userspace") Assisted-by: Copilot:claude-opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Alex Hung [Tue, 16 Jun 2026 00:54:53 +0000 (18:54 -0600)]
drm/amd/display: Add KUnit tests for amdgpu_dm_replay
[WHAT]
Add KUnit coverage for amdgpu_dm_set_replay_caps(),
amdgpu_dm_link_setup_replay(), and amdgpu_dm_replay_set_event()
including happy-path tests that exercise the configuration logic,
coasting vtotal calculations, and early-return when replay events
are already in the desired state.
Assisted-by: Copilot:Claude-Opus-4.6 GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Harry Wentland [Tue, 16 Jun 2026 16:17:45 +0000 (12:17 -0400)]
drm/amd/display: guard against overflow in HDCP message dump
[Why]
mod_hdcp_dump_binary_message() computed target_size (a uint32_t) as roughly
byte_size * msg_size and gated the whole write on buf_size >= target_size. A
large msg_size can overflow target_size, wrapping it to a small value that
passes the check while the loop still writes byte_size * msg_size bytes
into buf. All current callers pass small constants so this is not reachable
today, but the unchecked arithmetic should be hardened.
[How]
Drop the overflow-prone target_size precomputation and instead bounds-check the
output position on every iteration, stopping once the next entry would not leave
room for the trailing terminator. This cannot overflow and, for oversized
messages, dumps as much as fits rather than printing nothing.
Fixes: 4c283fdac08a ("drm/amd/display: Add HDCP module") Assisted-by: Copilot:claude-opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Harry Wentland [Tue, 16 Jun 2026 15:29:03 +0000 (11:29 -0400)]
drm/amd/display: clamp DMUB AUX reply length to payload buffer
[Why]
amdgpu_dm_process_dmub_aux_transfer_sync() copies p_notify->aux_reply.length
bytes into payload->data without clamping. payload->data is typically a 16-byte
DPCD scratch buffer, while aux_reply.length is echoed from the sink via the DMUB
ring. While this is clamped by DMUB it's prudent to ensure we validate
this in the driver as well.
[How]
Clamp the copy to sizeof(aux_reply.data), the scratch buffer the reply was read
into, and use that for both the memcpy and the return value. For regular
transfers additionally clamp to payload->length to cover callers whose
destination buffer is smaller than 16 bytes. The write-status-update retry path
(dce_aux_transfer_with_retries) deliberately zeroes payload->length while still
expecting the partial-write status byte, so that bound is skipped in that case
to avoid dropping the reply. Also guard against a NULL payload->data.
Fixes: 81927e2808be ("drm/amd/display: Support for DMUB AUX") Assisted-by: Copilot:claude-opus-4.8 Reviewed-by: Alex Hung <alex.hung@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: Add block sequence support for bandwidth programming operations
[why]
Bandwidth clock programming build and execution phases were coupled,
preventing the HWSS from orchestrating them through block sequencing.
[how]
Separate clock programming into build and execute phases across
latest versions. Build phase populates the clk_mgr internal block
sequence array, then registers a single CLK_MGR_UPDATE_CLOCKS HWSS step.
Execute phase dispatches the pre-built sequence. Add HWSS operations for
clk_mgr_set_max_memclk, hubbub_program_watermarks, hubbub_program_arbiter,
and hubbub_program_compbuf_segments.
Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Signed-off-by: Bhuvanachandra Pinninti <BhuvanaChandra.Pinninti@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Alex Hung [Tue, 16 Jun 2026 15:47:28 +0000 (09:47 -0600)]
drm/amd/display: Fix KUnit test crash after global alpha change
[WHY]
amdgpu_dm_plane_fill_blending_from_plane_state added drm_to_adev() but
dm_test_fill_blending_global_alpha did not initialize
plane_state->plane, causing a NULL pointer dereference.
[HOW]
Add an amdgpu_device and drm_plane so the plane->dev
dereference is valid in the test.
Fixes: 829769f1cfe8 ("drm/amd/display: scale plane global alpha to 12 bits on DCN 4.2") Cc: PingLei.Lin@amd.com Assisted-by: Copilot:Claude-Opus-4.6 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
James Lin [Tue, 16 Jun 2026 07:33:20 +0000 (15:33 +0800)]
drm/amd/display: scale plane global alpha to 12 bits on DCN 4.2
[why]
On DCN 4.2 the global alpha is reported using 12 bits
(MPCC_GLOBAL_ALPHA spans bits [0:11]), whereas other ASICs such as
DCN 3.1.4 use an 8-bit field (MPCC_GLOBAL_ALPHA spans bits
[16:23]). The DRM plane alpha property is 16-bit and amdgpu_dm
unconditionally scaled it down by >> 8, which only matches the 8-bit
hardware field. On DCN 4.2 this fed a value that was 4 bits too small
into the 12-bit field, so the hardware applied the wrong global alpha
and the resulting blended output did not match the expected hw * alpha
value.
[how]
Detect DCN 4.2 via amdgpu_ip_version(adev, DCE_HWIP, 0) and scale the
16-bit plane alpha by >> 4 to fill the 12-bit MPCC_GLOBAL_ALPHA field.
All other ASICs keep the existing >> 8 behavior for their 8-bit field.
Reviewed-by: ChiaHsuan (Tom) Chung <chiahsuan.chung@amd.com> Signed-off-by: James Lin <PingLei.Lin@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[WHAT]
Use an early guard for invalid DMUB notify callback registration inputs.
This keeps the same accepted and rejected cases while removing the
redundant else block.
Assisted-by: Copilot:GPT-5 Reviewed-by: Chen-Yu Chen <chen-yu.chen@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Alex Hung [Mon, 15 Jun 2026 21:42:59 +0000 (15:42 -0600)]
drm/amd/display: Simplify boolean checks
[WHAT]
Use direct boolean in connector and IRQ code paths. This removes
redundant comparisons around MST state, IRQ validation, handler
removal, and DMUB notification offload without changing behavior.
Assisted-by: Copilot:GPT-5 Reviewed-by: Chen-Yu Chen <chen-yu.chen@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Alex Hung [Sat, 13 Jun 2026 02:25:05 +0000 (20:25 -0600)]
drm/amd/display: Add more KUnit tests for amdgpu_dm_colorop
[WHAT]
Add KUnit coverage for amdgpu_dm_initialize_default_pipeline()
using an amdgpu_device-backed DRM mock so drm_to_adev() and
the DC color capability checks are exercised.
Assisted-by: Copilot:GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Alex Hung [Fri, 12 Jun 2026 23:20:27 +0000 (17:20 -0600)]
drm/amd/display: Extract backlight helpers for KUnit tests
[WHAT]
Extract shared backlight device index lookup and property
setup into testable helpers. The duplicated bd-to-index
scan in update_status/get_brightness is replaced by
amdgpu_dm_backlight_get_device_index(), and the inline
backlight_properties calculation is replaced by
amdgpu_dm_backlight_fill_props().
Add KUnit coverage for both new helpers. Keep the runtime
power_supply_is_system_supplied() call at the caller so
the helpers remain pure and deterministic under test.
Assisted-by: Copilot:GPT-5.5 Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com> Signed-off-by: Alex Hung <alex.hung@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Wenjing Liu [Wed, 10 Jun 2026 02:21:16 +0000 (22:21 -0400)]
drm/amd/display: Replace repeated no-native-i2c checks with force_i2c_over_aux field
[Why]
The compound condition checking dp_connector_no_native_i2c
and no_ddc_pin was duplicated across many files, obscuring
intent at every call site.
[How]
Add bool force_i2c_over_aux to struct dc_link, initialized
once during link creation. Add link_get_ddc_aux_inst()
helper to select the correct aux instance. Wire into
link_service via construct_link_service_ddc(). Replace all
duplicated condition checks and aux instance selection
blocks with the new field and helper. No functional change.
Reviewed-by: Nevenko Stupar <nevenko.stupar@amd.com> Signed-off-by: Wenjing Liu <wenjing.liu@amd.com> Signed-off-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Yongqiang Sun [Tue, 23 Jun 2026 19:24:11 +0000 (15:24 -0400)]
drm/amdkfd: use node XCC count for v9 CRIU control stack restore
set_queue_properties_from_criu() divided the checkpointed control stack
size by NUM_XCC(adev->gfx.xcc_mask) (whole GPU), while the checkpoint
size was recorded, the MQD buffer allocated, and the control stack
restored using the per-node mask NUM_XCC(mm->dev->xcc_mask). On spatially
partitioned GFX9.4.3 (CPX/QPX) these differ, so the per-XCC control stack
size used for the restore memcpy could exceed the region sized for the
MQD allocation, writing past the BO into adjacent kernel memory; it also
broke legitimate restore on partitioned parts.
Divide by the per-node XCC count so allocation and copy agree,
leaving kfd_queue_acquire_buffers() to bound the size against
the node's advertised control stack size.
Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com> Reviewed-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
James Zhu [Wed, 3 Sep 2025 21:21:00 +0000 (17:21 -0400)]
drm/amdkfd: move TBA/TMA from system to device memory
for GFX9.4.2 and above.
-v2: keep APU with GTT allocation
-v3: use dev->adev->apu_prefer_gtt instead
Signed-off-by: James Zhu <James.Zhu@amd.com> Reviewed-by: Vladimir Indic <vladimir.indic@amd.com> Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com> Reviewed-by: Philip Yang <philip.yang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
James Zhu [Thu, 25 Sep 2025 20:13:58 +0000 (16:13 -0400)]
drm/amdkfd: Add domain parameter to kernel BO mapping function
This change allows amdgpu_amdkfd_gpuvm_map_bo_to_kernel() to pin buffers
in either GTT or VRAM based on caller specification, providing flexibility
for different memory placement requirements across various kernel buffers.
The domain parameter accepts AMDGPU_GEM_DOMAIN_GTT, AMDGPU_GEM_DOMAIN_VRAM,
or their combination (GTT|VRAM) to let amdgpu_bo_pin() choose the optimal
placement via amdgpu_bo_get_preferred_domain(). This flexible validation
allows callers to specify their preference while delegating final placement
decisions to the driver when appropriate.
CPU visibility is automatically enforced by amdgpu_bo_pin() regardless of
the domain parameter (see amdgpu_bo_pin() line 975-976 which sets
AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED for kernel mappings).
Signed-off-by: James Zhu <James.Zhu@amd.com> Reviewed-by: Vladimir Indic <vladimir.indic@amd.com> Reviewed-by: Philip Yang <philip.yang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Honglei Huang [Thu, 25 Jun 2026 08:23:47 +0000 (16:23 +0800)]
drm/amd/display: use kvzalloc to allocate struct dc
struct dc has grown large over time (most of it the two inlined
dc_scratch_space copies) and now sits close to the page allocator's 4 MiB
contiguous allocation limit. Its actual size is not fixed by the source
alone, it also depends on the compiler and the .config, so it can easily
cross 4 MiB, e.g. with a newer GCC or a config change.
dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the
request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER,
so the page allocator warns and returns NULL. dc_create() then fails, DM
init fails and amdgpu probe aborts with -EINVAL:
dc_create() then returns NULL and DM init fails, which aborts the whole
GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block
<dm> failed -22"), leaving the display unusable. The subsequent
amdgpu_irq_put() warnings during teardown are just fallout of unwinding
a half-initialized device.
struct dc is a software-only bookkeeping structure that is never handed
to hardware DMA and is only ever kept as an opaque pointer, so it does
not require physically contiguous memory. Allocate it with kvzalloc()
(and free it with kvfree()) so that the allocator can fall back to
vmalloc() when a contiguous allocation of that size is not available,
which also avoids the MAX_PAGE_ORDER warning entirely.
v2:
- Rebase to amd-staging-drm-next.
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5406 Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Honglei Huang <honghuan@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Zhu Lingshan [Wed, 24 Jun 2026 07:52:35 +0000 (15:52 +0800)]
drm/amdgpu: reject mapping a reserved doorbell to a new queue
When creating an user-queue, the user space
provides a doorbell BO handle and an offset within
the bo to obtain a doorbell.
However current implementation using xa_store_irq()
to store a doorbell, which allows a later queue created
with the same BO and offset parameters to overwrite an
existing queue and doorbell mapping.
This can cause problems like misrouting fence IRQ
processing to a wrong queue, and mislead the cleanup
process of one queue erasing the mapping of another queue.
This commit fixes this issue by replacing xa_store_irq with
xa_insert_irq, which rejects mapping a reserved
doorbell to a newly created queue
Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Asad Kamal [Tue, 23 Jun 2026 00:00:00 +0000 (00:00 +0000)]
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc,
vddci and vddmem lookup tables without bounds checks across nine sites.
Return -EINVAL when any index is out of range.
Fixes: f83a9991648b ("drm/amd/powerplay: add Vega10 powerplay support (v5)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Asad Kamal [Tue, 23 Jun 2026 00:00:00 +0000 (00:00 +0000)]
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
vddInd and vddcInd fields from VBIOS-parsed tables are used to index into
voltage lookup tables without a bounds check. Return -EINVAL when any
index is out of range.
Fixes: c82baa281843 ("drm/amd/powerplay: add Tonga dpm support (v3)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
v1:
Tonga PPTable parsing also relies on VBIOS offsets, revision fields
and entry counts for several subtables. Malformed data can cause
out-of-bounds reads, while voltage lookup tables can overrun their
fixed-size destination arrays.
Add common bounds helpers and validate fixed subtables, dynamic entry
arrays and revision-specific layouts before consuming voltage lookup,
dependency, PCIE, power-tune, hard-limit, thermal, fan, GPIO, PPM and
VCE state data.
v2:
correct to handle get_tonga_ppm_table() return value.
Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
v1:
Vega10 PPTable parsing uses VBIOS-provided offsets, revision fields
and entry counts to locate subtables. Malformed data can otherwise
drive out-of-bounds reads from soft_pp_table_size, and voltage lookup
tables can overrun their fixed-size destination arrays.
Add shared bounds helpers and validate fixed-size subtables, dynamic
entry arrays and revision-specific layouts before consuming thermal,
fan, power-tune, clock dependency, PCIE, hard-limit and voltage lookup
data.
v2:
if ucRevId is not matched, fallback to default table size instead of returning -EINVAL.
Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
processpptables.c walks several variable-length PPLIB tables by
using offsets from the VBIOS PowerPlay table. Some paths dereference
extended headers, state arrays, clock arrays, non-clock arrays, or VCE
records before checking that the referenced data is inside the table
buffer.
Add local bounds helpers and validate the relevant offsets and entry
sizes before dereferencing them. This prevents truncated or malformed
legacy PowerPlay tables from driving out-of-bounds reads during hwmgr
initialization and table entry lookup.
Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
The Vega hwmgr PowerPlay table parsers read fixed table fields,
state array entries, or SMC PPT fields before validating that the
VBIOS table buffer covers those structures. A truncated table can
therefore lead to out-of-bounds reads during hwmgr initialization.
Reject tables smaller than the fixed PowerPlay table. For Vega10, also
validate the state array offset and entry range before dereferencing
the state array.
Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Yang Wang [Tue, 23 Jun 2026 03:36:39 +0000 (11:36 +0800)]
drm/amd/pm: Validate Tonga PowerPlay state array bounds
process_pptables_v1_0.c builds the Tonga state array pointer
from usStateArrayOffset before checking that the table buffer covers
the referenced data. A truncated PowerPlay table can therefore lead to
out-of-bounds reads while validating the state array.
Validate the fixed table size first, then check the state array offset
and entry range before dereferencing the state array.
Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Remove unnecessary SIGNAL_TYPE_HDMI_TYPE_A check that was performed in the
drm_mode_is_420_only() case, but not in the drm_mode_is_420_also() &&
force_yuv420_output case.
Without further knowledge if YCbCr 4:2:0 is supported outside of HDMI,
there is no reason to use RGB when the display
reports drm_mode_is_420_only() even on a non HDMI connection.
This patch also moves both checks in the same if-case. This eliminates an
extra else-if-case.
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Signed-off-by: Andri Yngvason <andri@yngvason.is> Tested-by: Andri Yngvason <andri@yngvason.is> Reviewed-by: Daniel Stone <daniel@fooishbar.org> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
The mode-setting pipeline can disabled damage clippings for a commit
by setting ignore_damage_clips in struct drm_plane_state. The commit
will then do a full display update.
Test the flag in DCN code and do a full update in DCN code if it has
been set.
Commit 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers
to ignore damage clips") introduced ignore_damage_clips to selectively
ignore damage clipping in certain framebuffer changes. This driver does
not do that, but DRM's damage iterator will soon rely on the flag.
Therefore supporting it here as well make sense for consistency.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 35ed38d58257 ("drm: Allow drivers to indicate the damage helpers to ignore damage clips") Cc: Javier Martinez Canillas <javierm@redhat.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Zack Rusin <zackr@vmware.com> Cc: dri-devel@lists.freedesktop.org Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Same write-OOB and read-OOB as the Tonga fix, across seven Vega10 sub-table
parsers: get_vddc_lookup_table(), get_mm_clock_voltage_table(),
get_socclk/mclk/gfxclk/pixclk/dcefclk_voltage_dependency_table().
The GFXCLK table selects the correct record size per revision.
Fixes: f83a9991648b ("drm/amd/powerplay: add Vega10 powerplay support (v5)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
ucNumEntries in the Tonga/Polaris PowerPlay sub-tables is used as both the
kzalloc count and loop bound without validation, allowing a crafted VBIOS
to overflow the destination heap object and read past the VBIOS image.
Clamp via pp_entries_max() in get_vddc_lookup_table(),
get_mclk_voltage_dependency_table(), get_sclk_voltage_dependency_table()
and get_mm_clock_voltage_table().
Fixes: c82baa281843 ("drm/amd/powerplay: add Tonga dpm support (v3)") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Asad Kamal [Tue, 23 Jun 2026 00:00:00 +0000 (00:00 +0000)]
drm/amdgpu/pm: add pp_entries_max() helper
Add a static inline that returns the maximum safe record count for a
PowerPlay sub-table, bounded by the lesser of soft_pp_table_size and
adev->bios_size. Uses adev->bios directly to avoid a dependency on
struct atom_context. Subsequent patches use it to clamp ucNumEntries.
Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Asad Kamal [Mon, 22 Jun 2026 16:25:04 +0000 (00:25 +0800)]
drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
Reject voltage objects whose usSize is smaller than the header or would
advance the cursor past the table end, preventing an infinite loop or
heap OOB read when the VBIOS supplies a malformed VoltageObjectInfo table.
Fixes: c82baa281843 ("drm/amd/powerplay: add Tonga dpm support (v3)") Fixes: 0d2c7569e196 ("drm/amdgpu: add new atomfirmware based helpers for powerplay") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Yang Wang <kevinyang.wang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Yongqiang Sun [Tue, 2 Jun 2026 13:47:19 +0000 (09:47 -0400)]
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size
from hardware without bounding it to the allocated BO region. If the HW
field is larger than the queue's control stack allocation, memcpy reads
past the BO into adjacent GTT memory and can leak kernel data to userspace.
Store the page-aligned control stack BO size in mqd_manager and clamp
checkpoint copies and reported checkpoint sizes to
min(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound
for multi-XCC v9.4.3 checkpoint layout.
Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com> Reviewed-by: David Francis <David.Francis@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Asad Kamal [Sun, 14 Jun 2026 04:50:28 +0000 (12:50 +0800)]
drm/amdgpu: fix aperture mapping leak
amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver
fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to
always return false, so iounmap(aper_base_kaddr) never runs on normal
driver unload, leaving an orphaned entry in the x86 PAT interval tree.
On connected_to_cpu hardware, the aperture is mapped write-back (WB) via
ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC)
over the same range. The WC vs WB conflict causes:
Fix by switching to devres-managed mappings so cleanup is guaranteed
regardless of drm_dev_enter() state:
- connected_to_cpu path: devm_memremap(MEMREMAP_WB). For
IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut,
returning __va(offset) from the existing kernel direct map. No new
ioremap VA or PAT entry is created, so there is nothing to orphan.
- dGPU path: devm_ioremap_wc() registers iounmap() as a devres action,
guaranteeing cleanup at device_del() time.
Also remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio()
since the mapping is now devres-owned.
v2: Remove redundant x86_64 guard (Lijo)
Fixes: 9d0af8b4def0 ("drm/amdgpu: pre-map device buffer as cached for A+A config") Signed-off-by: Asad Kamal <asad.kamal@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Yang Wang [Tue, 23 Jun 2026 03:36:20 +0000 (11:36 +0800)]
drm/amd/pm: Use uploaded size for legacy custom PPTable
The legacy powerplay path used to allocate hardcode_pp_table from
the original VBIOS PPTable size, copy only the uploaded bytes into it,
and keep soft_pp_table_size unchanged. If a custom PPTable is shorter
than the original table, later code can still treat the stale tail as
valid table data.
Treat the uploaded buffer as the complete custom PPTable: duplicate the
uploaded buffer directly, replace hardcode_pp_table atomically, and set
soft_pp_table_size to the uploaded size.
Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Yang Wang [Mon, 22 Jun 2026 16:04:33 +0000 (00:04 +0800)]
drm/amd/pm: Validate pp_table header before reading size
smu_sys_set_pp_table() reads usStructureSize from the uploaded
pp_table buffer before validating that the buffer contains a complete
ATOM_COMMON_TABLE_HEADER. A short write can therefore make the driver
read past the supplied sysfs buffer.
Reject empty or header-short uploads before dereferencing the header
pointer.
Keep the existing structure-size check for the full uploaded table.
Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Jesse Zhang [Thu, 11 Jun 2026 02:26:04 +0000 (10:26 +0800)]
drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq
Try KQ by ring_id first (KCQ and UQ never share a HW slot); fall back
to amdgpu_userq_process_fence_irq() on miss, since KCQ EOPs were
misrouted into the userq fence path when enable_mes is true.
Require a strict (me,pipe,queue) match in the gfx case, then userq gfx
EOPs fall through to amdgpu_userq_process_fence_irq().
Suggested-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Jesse Zhang [Thu, 11 Jun 2026 02:14:32 +0000 (10:14 +0800)]
drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq
Try KQ by ring_id first (KCQ and UQ never share a HW slot); fall back
to amdgpu_userq_process_fence_irq() on miss, since KQ EOPs were
misrouted into the userq fence path when enable_mes is true.
Require a strict (me,pipe,queue) match in the gfx case, then userq gfx
EOPs fall through to amdgpu_userq_process_fence_irq().
Suggested-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Jesse Zhang [Tue, 9 Jun 2026 02:00:56 +0000 (10:00 +0800)]
drm/amdgpu/gfx12: handle error interrupts for userqs
Call the new userq reset helper, and dispatch KQs first by ring_id
before falling back to the user-queue lookup.
v2: squash in fixes
Co-developed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <jesse.zhang@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Melissa Wen [Tue, 23 Jun 2026 15:59:01 +0000 (17:59 +0200)]
drm/amd/display: use halving distribution for PQ/sRGB linearizing LUT
When linearizing, the input is an encoded signal bounded to [0,1] and
PQ/sRGB EOTFs are steepest near 1, requiring more precision near the
bright end.
Take the 8-bit sRGB case as a reference: 256 possible inputs and 256 HW
LUT points line up, so the LUT acts as plain indexing. Float
representations don't land perfectly, but LERP-ing between two HW
entries, when input is within a small epsilon of one of them, doesn't
materially change the result.
Replace the uniform 12-region distribution (16 points each,
192 total, range [2^-12, 1]) with a 9-region halving distribution for
the PQ/sRGB pre-defined EOTF: 128 points in the top region [0.5, 1], 64
in the next, 32 in the next, and so on, down to 1 point in each of the
two darkest regions. Total samples grow from 192 to 256, with uniform
1/256 spacing across [0, 1]. The dark tail below 2^-9 is no longer
sampled separately, which is acceptable for PQ/sRGB.
Suggested-by: Krunoslav Kovac <Krunoslav.Kovac@amd.com> Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Melissa Wen [Tue, 23 Jun 2026 15:59:00 +0000 (17:59 +0200)]
drm/amd/display: support up to 256 samples per region in degamma/blend LUT
cm3_helper_translate_curve_to_degamma_hw_format() reads one tf_pts entry
per HW LUT point, limiting the number of samples per region to
NUMBER_SW_SEGMENTS (16, at seg_distr[k] = 4) - higher seg_distr[k]
underflows the increment to 0. But the next patch introduces a halving
distribution for PQ/sRGB EOTFs that requires up to 128 samples in its
upper region (seg_distr[k] = 7).
As preparation, extend the loop index by 4 bits and linearly interpolate
adjacent tf_pts entries with the new interp_tf_pts() helper, where the 4
least significant bits are weight in 1/16 increments. This raises the
cap to 256 samples per region (seg_distr[k] = 8). seg_distr[k] <= 4
paths remain unchanged: the 4 least significant bits remain zero and
interp_tf_pts() reduces to a direct lookup.
Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Co-developed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Melissa Wen [Tue, 23 Jun 2026 15:58:59 +0000 (17:58 +0200)]
drm/amd/display: use a separate helper to translate degamma curves
In newer DCN families, there is no hw predefined curves for shaper,
blend and regamma. When userspace sets pre-defined curves for these
blocks, the driver uses AMD color module to program predefined curve as
LUT. However, it was using the same LUT segmentation for EOTF and
inverse EOTF by using the same color management helper. This is causing
banding on blend when PQ predefined curve is set. Besides that, degamma
predefined HW curve cannot be used with subsampled 4:2:0/4:2:2 formats
as it affects the linearity of color space in which HW scaler operates.
To mitigate banding when using the blend block and better support
subsampled format on degamma, use different translation helpers when
linearizing and delinearizing.
Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
So that we can detach NL->L LUT programming from L->NL one, i.e., we can
use cm3_helper_translate_curve_to_degamma_hw_format for plane degamma and
blend (post-3DLUT curve) and cm3_helper_translate_curve_to_hw_format for
plane shaper (pre-3DLUT curve) and stream regamma.
Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Melissa Wen [Tue, 23 Jun 2026 15:58:57 +0000 (17:58 +0200)]
drm/amd/display: use GAMCOR for degamma private props in subsampled format
When setting plane degamma TF via AMD driver-specific color properties,
the driver uses PRE_DEGAM color block (ROM). However, this block cannot
be used with subsampled formats as it affects the linearity of color
space in which HW scaler operates. For subsampled format, use the AMD
color module to map plane degamma predefined curve to LUT and use GAMCOR
block instead (RAM).
This is based on Harry's implementation for Fixed Matrix Colorop.
Link: https://lore.kernel.org/dri-devel/20260330153451.99472-1-harry.wentland@amd.com/ Co-developed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Harry Wentland <harry.wentland@amd.com> Tested-by: Matthew Schwartz <matthew.schwartz@linux.dev> Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu: don't free standalone ip_discovery sysfs in sysfs_fini
The standalone_mode ip_discovery sysfs hierarchy is tied to the PCI
device lifetime and tracked in early_ip_discovery_list. It is torn down
only by amdgpu_discovery_sysfs_early_fini() on driver unbind, which is
why amdgpu_discovery_fini() already guards its teardown with
!standalone_mode.
Commit 7de02fe95312 ("drm/amdgpu: clean up discovery and preempt sysfs
entries on shutdown") added an unconditional amdgpu_discovery_sysfs_fini()
call in amdgpu_device_sys_interface_fini(), which runs during
amdgpu_device_fini_hw() on every unbind/reload. On reload this freed the
PCI-device-owned ip_top via kobject_put()->ip_disc_release()->kfree(),
leaving a dangling pointer in early_ip_discovery_list. The subsequent
amdgpu_discovery_sysfs_early_fini() then dereferenced and put the freed
object, causing a use-after-free and double-free, and prematurely
destroyed the sysfs that was meant to persist across reloads.
Make amdgpu_discovery_sysfs_fini() skip standalone_mode objects so the
invariant is centralized at the teardown site and the new call site
cannot free the PCI-device-owned ip_top. Teardown of standalone sysfs
remains the sole responsibility of amdgpu_discovery_sysfs_early_fini().
Fixes: 7de02fe95312 ("drm/amdgpu: clean up discovery and preempt sysfs entries on shutdown") Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Eric Huang [Thu, 11 Jun 2026 15:39:33 +0000 (11:39 -0400)]
drm/amdkfd: avoid race condition of mqd when reading sdma counter
MQD used outside of dpm_lock is unsafe because the queue could be
destroyed during the window of dqm_unlock, moving into dqm_lock
range is the best practice.
Signed-off-by: Eric Huang <jinhuieric.huang@amd.com> Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: convert dcn42 GPIO translation to lookup tables
Replace dcn42 GPIO translation switch statements with the
generic table-based translation helpers.
This simplifies the GPIO mapping logic and reduces duplicated
translation code.
No functional changes intended.
Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: convert dcn401 GPIO translation to lookup tables
Replace dcn401 GPIO translation switch statements with the
generic table-based translation helpers.
This simplifies the GPIO mapping logic and reduces duplicated
translation code.
No functional changes intended.
Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: convert dcn32 GPIO translation to lookup tables
Replace dcn32 GPIO translation switch statements with the
generic table-based translation helpers.
This simplifies the GPIO mapping logic and reduces duplicated
translation code.
No functional changes intended.
Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: convert dcn315 GPIO translation to lookup tables
Replace dcn315 GPIO translation switch statements with the
generic table-based translation helpers.
This simplifies the GPIO mapping logic and reduces duplicated
translation code.
No functional changes intended.
Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drm/amd/display: convert dcn30 GPIO translation to lookup tables
Replace dcn30 GPIO translation switch statements with the
generic table-based translation helpers.
This simplifies the GPIO mapping logic and reduces duplicated
translation code.
No functional changes intended.
Signed-off-by: Guilherme Ivo Bozi <guilherme.bozi@usp.br> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Acked-by: George Zhang <george.zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
projects / linux / log