Commit a0c83177 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernel 

Pull drm fixes from Dave Airlie:
 "Regular weekly pull request, from sunny San Diego. Usual suspects in
  xe/i915/amdgpu with small fixes all over, then some minor fixes across
  a few other drivers. It's probably a bit on the heavy side, but most
  of the fix seem well contained,

  core:
   - drm_dev_unplug UAF fix

  pagemap:
   - lock handling fix

  xe:
   - A number of teardown fixes
   - Skip over non-leaf PTE for PRL generation
   - Fix an uninitialized variable
   - Fix a missing runtime PM reference

  i915/display:
   - Fix #15771: Screen corruption and stuttering on P14s w/ 3K display
   - Fix for PSR entry setup frames count on rejected commit
   - Fix OOPS if firmware is not loaded and suspend is attempted
   - Fix unlikely NULL deref due to DC6 on probe

  amdgpu:
   - Fix gamma 2.2 colorop TFs
   - BO list fix
   - LTO fix
   - DC FP fix
   - DisplayID handling fix
   - DCN 2.01 fix
   - MMHUB boundary fixes
   - ISP fix
   - TLB fence fix
   - Hainan pm fix

  radeon:
   - Hainan pm fix

  vmwgfx:
   - memory leak fix
   - doc warning fix

  imagination:
   - deadlock fix
   - interrupt handling fixes

  dw-hdmi-qp:
   - multi channel audio fix"

* tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernel: (40 commits)
  drm/xe: Fix missing runtime PM reference in ccs_mode_store
  drm/xe: Open-code GGTT MMIO access protection
  drm/xe/lrc: Fix uninitialized new_ts when capturing context timestamp
  drm/xe/oa: Allow reading after disabling OA stream
  drm/xe: Skip over non leaf pte for PRL generation
  drm/xe/guc: Ensure CT state transitions via STOP before DISABLED
  drm/xe: Trigger queue cleanup if not in wedged mode 2
  drm/xe: Forcefully tear down exec queues in GuC submit fini
  drm/xe: Always kill exec queues in xe_guc_submit_pause_abort
  drm/xe/guc: Fail immediately on GuC load error
  drm/i915/gt: Check set_default_submission() before deferencing
  drm/radeon: apply state adjust rules to some additional HAINAN vairants
  drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
  drm/amdgpu: rework how we handle TLB fences
  drm/bridge: dw-hdmi-qp: fix multi-channel audio output
  drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
  drm/amdgpu: Fix ISP segfault issue in kernel v7.0
  drm/amdgpu/gmc9.0: add bounds checking for cid
  drm/amdgpu/mmhub4.2.0: add bounds checking for cid
  drm/amdgpu/mmhub4.1.0: add bounds checking for cid
  ...
parents 42bddab0 a6e77320

drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c

+4 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ 


#define AMDGPU_BO_LIST_MAX_PRIORITY	32u

#define AMDGPU_BO_LIST_NUM_BUCKETS	(AMDGPU_BO_LIST_MAX_PRIORITY + 1)

#define AMDGPU_BO_LIST_MAX_ENTRIES	(128 * 1024)



static void amdgpu_bo_list_free_rcu(struct rcu_head *rcu)

{
@@ -188,6 +189,9 @@ int amdgpu_bo_create_list_entry_array(struct drm_amdgpu_bo_list_in *in, 
	const uint32_t bo_number = in->bo_number;

	struct drm_amdgpu_bo_list_entry *info;



	if (bo_number > AMDGPU_BO_LIST_MAX_ENTRIES)

		return -EINVAL;



	/* copy the handle array from userspace to a kernel buffer */

	if (likely(info_size == bo_info_size)) {

		info = vmemdup_array_user(uptr, bo_number, info_size);

drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c

+6 −1
Original line number Diff line number Diff line
@@ -1069,7 +1069,10 @@ amdgpu_vm_tlb_flush(struct amdgpu_vm_update_params *params, 
	}



	/* Prepare a TLB flush fence to be attached to PTs */

	if (!params->unlocked) {

	/* The check for need_tlb_fence should be dropped once we

	 * sort out the issues with KIQ/MES TLB invalidation timeouts.

	 */

	if (!params->unlocked && vm->need_tlb_fence) {

		amdgpu_vm_tlb_fence_create(params->adev, vm, fence);



		/* Makes sure no PD/PT is freed before the flush */
@@ -2602,6 +2605,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm, 
	ttm_lru_bulk_move_init(&vm->lru_bulk_move);



	vm->is_compute_context = false;

	vm->need_tlb_fence = amdgpu_userq_enabled(&adev->ddev);



	vm->use_cpu_for_update = !!(adev->vm_manager.vm_update_mode &

				    AMDGPU_VM_USE_CPU_FOR_GFX);
@@ -2739,6 +2743,7 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm) 
	dma_fence_put(vm->last_update);

	vm->last_update = dma_fence_get_stub();

	vm->is_compute_context = true;

	vm->need_tlb_fence = true;



unreserve_bo:

	amdgpu_bo_unreserve(vm->root.bo);

drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h

+2 −0
Original line number Diff line number Diff line
@@ -441,6 +441,8 @@ struct amdgpu_vm { 
	struct ttm_lru_bulk_move lru_bulk_move;

	/* Flag to indicate if VM is used for compute */

	bool			is_compute_context;

	/* Flag to indicate if VM needs a TLB fence (KFD or KGD) */

	bool			need_tlb_fence;



	/* Memory partition number, -1 means any partition */

	int8_t			mem_id;

drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c

+14 −7
Original line number Diff line number Diff line
@@ -662,28 +662,35 @@ static int gmc_v9_0_process_interrupt(struct amdgpu_device *adev, 
	} else {

		switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {

		case IP_VERSION(9, 0, 0):

			mmhub_cid = mmhub_client_ids_vega10[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega10) ?

				mmhub_client_ids_vega10[cid][rw] : NULL;

			break;

		case IP_VERSION(9, 3, 0):

			mmhub_cid = mmhub_client_ids_vega12[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega12) ?

				mmhub_client_ids_vega12[cid][rw] : NULL;

			break;

		case IP_VERSION(9, 4, 0):

			mmhub_cid = mmhub_client_ids_vega20[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vega20) ?

				mmhub_client_ids_vega20[cid][rw] : NULL;

			break;

		case IP_VERSION(9, 4, 1):

			mmhub_cid = mmhub_client_ids_arcturus[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_arcturus) ?

				mmhub_client_ids_arcturus[cid][rw] : NULL;

			break;

		case IP_VERSION(9, 1, 0):

		case IP_VERSION(9, 2, 0):

			mmhub_cid = mmhub_client_ids_raven[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_raven) ?

				mmhub_client_ids_raven[cid][rw] : NULL;

			break;

		case IP_VERSION(1, 5, 0):

		case IP_VERSION(2, 4, 0):

			mmhub_cid = mmhub_client_ids_renoir[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_renoir) ?

				mmhub_client_ids_renoir[cid][rw] : NULL;

			break;

		case IP_VERSION(1, 8, 0):

		case IP_VERSION(9, 4, 2):

			mmhub_cid = mmhub_client_ids_aldebaran[cid][rw];

			mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_aldebaran) ?

				mmhub_client_ids_aldebaran[cid][rw] : NULL;

			break;

		default:

			mmhub_cid = NULL;

drivers/gpu/drm/amd/amdgpu/isp_v4_1_1.c

+2 −2
Original line number Diff line number Diff line
@@ -129,7 +129,7 @@ static int isp_genpd_add_device(struct device *dev, void *data) 
	if (!pdev)

		return -EINVAL;



	if (!dev->type->name) {

	if (!dev->type || !dev->type->name) {

		drm_dbg(&adev->ddev, "Invalid device type to add\n");

		goto exit;

	}
@@ -165,7 +165,7 @@ static int isp_genpd_remove_device(struct device *dev, void *data) 
	if (!pdev)

		return -EINVAL;



	if (!dev->type->name) {

	if (!dev->type || !dev->type->name) {

		drm_dbg(&adev->ddev, "Invalid device type to remove\n");

		goto exit;

	}