Several kfd ioctls need transfer array data from/to user space. Kfd driver
uses kmalloc_array with user provided size. That can oversize alloc or 32-bit
wrap with hostile value. Replace it by memdup_array_user that does overflow
checking and allocates through dedicated slab caches, also physical continuous
as kmalloc.
Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
If inx from find_first_zero_bit is beyond range not need set doorbell_bitmap.
Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
amdkfd driver needs allocate buffer to return bo metadata to user space. The
buffer size is controlled by user currently. It is a potential security issue
that hostile value (e.g. 2 GiB) lets any render-group user trigger order-MAX
allocation/OOM in kernel context.
This patch first finds bo metadata size. If the size is smaller than user
provided value drive can safely allocate buffer in kernel space and copy to
user space buffer. If not, driver will let user know, not allocate and copy.
User will redo with new buffer in user space.
This patch lets driver decide buffer allocation size to avoid potential hostile
size from user space.
Signed-off-by: Xiaogang Chen <xiaogang.chen@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Fix a sysfs duplication error when reinitializing the device:
sysfs: cannot create duplicate filename '.../ip_discovery'
kobject_add_internal failed for ip_discovery with -EEXIST
...
Failed to create device file mem_info_preempt_used (-17)
The failure is caused by stale sysfs entries not being removed during
device teardown, leading to -EEXIST when the driver is reprobed. In
particular:
- amdgpu_discovery sysfs kobjects were not fully torn down early enough,
and ip_top remained non-NULL after cleanup
- the preempt manager sysfs attribute was removed only conditionally
and not during the common hw fini path
Fix this by:
- making amdgpu_discovery_sysfs_fini() externally visible and clearing
adev->discovery.ip_top to prevent reuse
- calling amdgpu_discovery_sysfs_fini() and
amdgpu_preempt_mgr_sysfs_fini() from
amdgpu_device_sys_interface_fini()
This ensures sysfs state is fully cleaned up before reprobe and avoids
duplicate kobject/file creation.
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
When dumping IB contents from a hung job, amdgpu_devcoredump_format()
acquired the VM root PD's reservation via amdgpu_vm_lock_by_pasid() and
then, for each IB, called amdgpu_bo_reserve() on the BO backing the IB.
Both reservations are reservation_ww_class_mutex objects and neither
used a ww_acquire_ctx, which trips lockdep:
WARNING: possible recursive locking detected
--------------------------------------------
kworker/u128:0 is trying to acquire lock:
ffff88838b16e1f0 (reservation_ww_class_mutex){+.+.}-{4:4},
at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]
but task is already holding lock:
ffff8882f82681f0 (reservation_ww_class_mutex){+.+.}-{4:4},
at: amdgpu_devcoredump_format+0x1594/0x23f0 [amdgpu]
Possible unsafe locking scenario:
CPU0
----
lock(reservation_ww_class_mutex);
lock(reservation_ww_class_mutex);
*** DEADLOCK ***
May be due to missing lock nesting notation
Workqueue: events_unbound amdgpu_devcoredump_deferred_work [amdgpu]
Call Trace:
__ww_mutex_lock.constprop.0
ww_mutex_lock
amdgpu_bo_reserve
amdgpu_devcoredump_format+0x1594 [amdgpu]
amdgpu_devcoredump_deferred_work+0xea [amdgpu]
The two reservations are on different BOs in the captured trace, so the
splat is a lockdep-correctness warning, not an observed deadlock. It
becomes a real self-deadlock whenever the IB BO shares its dma_resv with
the root PD (the always-valid case, see amdgpu_vm_is_bo_always_valid()):
amdgpu_bo_reserve(abo) re-acquires the same ww_mutex without a ticket
and blocks forever. With amdgpu.gpu_recovery=0 the timeout handler
refires every ~2 s and each invocation produces this splat, drowning the
kernel ring buffer.
Now that amdgpu_vm_lock_by_pasid() takes a drm_exec context, move the IB
dumping into a separate helper that locks the root PD and every IB BO
together in a single drm_exec ticket. DRM_EXEC_IGNORE_DUPLICATES handles
IB BOs that share a dma_resv (e.g. always-valid BOs, or two IBs backed
by the same BO). Every lock is now a top-level acquire under one
ww_acquire_ctx, so the recursive ww_mutex condition is gone, and the
per-IB amdgpu_bo_reserve()/amdgpu_bo_unref() dance -- including a BO
refcount leak on the amdgpu_bo_reserve() failure path -- is removed.
Fixes: 7b15fc2d1f ("drm/amdgpu: dump job ibs in the devcoredump")
Suggested-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
amdgpu_vm_lock_by_pasid() looks up a VM by PASID and reserves its root
PD with a bare amdgpu_bo_reserve(), returning the still-reserved root to
the caller. A caller that then needs to reserve further BOs (for example
the devcoredump IB dump) ends up nesting reservation_ww_class_mutex
acquires without a ww_acquire_ctx, which lockdep flags as recursive
locking.
Convert the helper to take a drm_exec context and lock the root PD with
drm_exec_lock_obj(). Callers now run it inside a
drm_exec_until_all_locked() loop and can lock additional BOs in the same
ww ticket, so there is no nested ww_mutex acquire.
The drm_exec context holds its own reference on the locked root BO, so
the helper no longer hands a root reference back to the caller: the
root output parameter is dropped, and the transient reference taken
across the PASID lookup is released before returning.
The only existing caller, amdgpu_vm_handle_fault(), is updated
accordingly. Its is_compute_context path, which previously dropped the
root reservation around svm_range_restore_pages() and re-took it, now
finalises the drm_exec context and re-initialises a fresh one; behaviour
is otherwise unchanged.
No functional change intended for the page-fault path.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
add buf length check before using it to access data
Signed-off-by: Gangliang Xie <ganglxie@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
The SDMA queue counter read was dispatched by GC version: anything newer
than gfx 9.4.2 was routed to the kfd2kgd->hqd_sdma_get_counter hook.
However that hook is only implemented for gfx 9.4.3, so gfx 10.3, gfx 11
and gfx 12 fell into the else branch with a NULL hook and got
-EOPNOTSUPP. This spammed "Failed to read SDMA queue counter" on every
SDMA queue teardown and left sdma_val at 0, so the per-process SDMA
activity accounting stopped working on those ASICs.
Dispatch based on whether the hook is implemented instead of the GC
version, so ASICs without the hook keep using read_sdma_queue_counter()
as before.
Fixes: 8f09c0ec21 ("drm/amdkfd: add sdma queue counter for gfxv9.4.3")
Reviewed-by: Eric Huang <jinhuieric.huang@amd.com>
Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Queue reset is not supported when running as an SR-IOV virtual function on gfx11 dGPUs.
Guard HSA_CAP_PER_QUEUE_RESET_SUPPORTED with !amdgpu_sriov_vf().
so the capability is not reported to user space under SR-IOV, matching the gfx9/gfx10 path.
Fixes: 9d748a8ac1 ("drm/amdkfd: Add queue reset support on gfx11 dGPU")
Signed-off-by: Amber Lin <Amber.Lin@amd.com>
Reviewed-by: Jesse Zhang <jesse.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Move kfd_process_remove_sysfs() earlier in kfd_process_wq_release() so
that all sysfs/procfs entries are removed before tearing down PDDs and
dropping lead_thread. The per-process sysfs attributes are backed by
struct kfd_process_device, and their show/store callbacks dereference
PDD fields. Since sysfs removal waits for active callbacks to complete,
removing these entries first closes a race where userspace reads sdma_*
and stats_* files after PDD teardown.
Previously this cleanup ran after kfd_process_destroy_pdds(), which
resets p->n_pdds to 0. This meant kfd_process_remove_sysfs() could no
longer walk the PDD array, so the per-PDD sysfs cleanup did not run as
intended.
This race caused NULL pointer dereferences observed in
kfd_sdma_activity_worker and kfd_procfs_stats_show.
Also harden kfd_process_remove_sysfs() against partially
initialized or already-freed objects:
- Check kobj_queues before removing PASID and deleting it
- Guard kobj_stats and kobj_counters before use
These checks prevent invalid dereferences during cleanup.
Cc: Felix Kuehling <Felix.Kuehling@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Add a minimum-length check for the AMDGPU_CHUNK_ID_CP_GFX_SHADOW chunk in
amdgpu_cs_pass1(), matching the gate already present for the IB, FENCE and
BO_HANDLES chunk types.
The CP_GFX_SHADOW case previously shared a bare break with the dependency
and syncobj chunk types, which do not dereference a fixed-size struct. When
userspace submits this chunk with length_dw == 0, vmemdup_array_user() is
called with size 0 and returns ZERO_SIZE_PTR, which passes the IS_ERR()
check. amdgpu_cs_p2_shadow() then dereferences chunk->kdata as a struct
drm_amdgpu_cs_chunk_cp_gfx_shadow (reading shadow->flags), faulting on the
ZERO_SIZE_PTR and causing a NULL-pointer dereference.
This is reachable by an unprivileged process in the render group. Reject
undersized chunks with -EINVAL during pass1 so the bad submission is
rejected before pass2 ever dereferences the data.
Fixes: ac9287055f ("drm/amdgpu: add gfx shadow CS IOCTL support")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
The AMDGPU_GEM_OP_GET_MAPPING_INFO path of amdgpu_gem_op_ioctl() looks
up the bo_va for the buffer object in the caller's VM via
amdgpu_vm_bo_find(), but uses the returned pointer without checking it.
amdgpu_vm_bo_find() returns NULL when the BO has no bo_va in that VM,
which is the normal case for a BO that has never been mapped. The result
is fed straight into amdgpu_vm_bo_va_for_each_valid_mapping(), which
expands to list_for_each_entry(mapping, &(bo_va)->valids, list) and
dereferences bo_va, causing a NULL pointer dereference.
This is reachable by any process able to issue the ioctl (render group)
simply by requesting mapping info for an unmapped BO.
Return -ENOENT when no bo_va is found, jumping to out_exec so the
drm_exec context and GEM object reference are released.
Fixes: 4d82724f7f ("drm/amdgpu: Add mapping info option for GEM_OP ioctl")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
For gfx9, queue reset is supported on gfx 9.4.3 and above.
Signed-off-by: Amber Lin <Amber.Lin@amd.com>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This part enumerates a UMSCH block under hardware id (22) at version
2.2.0 rather than under VCN. Add the UMSCH hardware id, an IP enum
slot, and the discovery name/map entries so it is recognized. No IP
block is wired up yet; this only makes the IP discoverable.
The multimedia IP setup assumed VCN/VCE/UVD was always present; handle
the case where it is absent so init does not fail with -EINVAL.
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Boyuan Zhang <Boyuan.Zhang@amd.com>
Signed-off-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
The cleanup tail of kfd_criu_resume_svm() walks
svms->criu_svm_metadata_list and kfree()s each struct criu_svm_metadata
without removing it from the list. The list head is left pointing at
freed kmalloc-96 objects.
A second AMDKFD_IOC_CRIU_OP from the same process re-enters: list_empty()
reads the dangling ->next (use-after-free), the loop walks freed entries,
and each is kfree()'d again (double-free). This is reachable by an
unprivileged render-group user via /dev/kfd with no capabilities required.
Add list_del() before the kfree() so the list is properly emptied. The
list_for_each_entry_safe() iterator already caches the next pointer, so
unlinking during the walk is safe.
Fixes: 2a909ae718 ("drm/amdkfd: CRIU resume shared virtual memory ranges")
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Single characters should occasionally be put into a sequence.
Thus use the corresponding function “seq_putc”.
The source code was transformed by using the Coccinelle software.
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Move the specification for a line break from a seq_puts() call
to a previous seq_printf() call.
This issue was detected by using the Coccinelle software.
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
When driver probe fails (missing firmware, unsupported hardware, etc.),
the entire device is torn down including the ip_discovery sysfs folder,
preventing users from identifying what hardware is present.
Export ip_discovery sysfs even when probe fails by creating it early
in the probe flow and tying its lifetime to the PCI device rather than
the driver. The sysfs folder persists across probe failures and module
reloads, but is cleaned up on driver unbind.
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
r600_parse_extended_power_table() uses manual kfree() calls for some
early allocation failures, but the freed pointers are left in the
dynamic power-management state. If device teardown later calls
r600_free_extended_power_table(), those stale pointers can be freed
again.
Use the common extended power table cleanup helper for those early
failure paths as well, and clear each pointer after freeing it so
repeated cleanup stays safe.
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
r100_copy_blit() copies BOs as 1024-pixel-wide ARGB8888 blits, so one
GPU page becomes one blit row. Large copies are split into chunks of at
most 8191 rows.
The kernel register header names the packet coordinate dwords SRC_Y_X
and DST_Y_X. In the BITBLT_MULTI description in
R5xx_Acceleration_v1.5.pdf docs, these correspond to [SRC_X1 | SRC_Y1]
and [DST_X1 | DST_Y1], which are signed 13-bit coordinates in the
-8192..8191 range. The old code kept SRC/DST_PITCH_OFFSET at the BO base
and used SRC_Y_X/DST_Y_X as the chunk address, so large BO moves could
exceed that coordinate range.
Compute per-chunk SRC/DST_PITCH_OFFSET bases and emit zero source and
destination coordinates. r100_copy_blit() already packs
SRC/DST_PITCH_OFFSET as pitch plus base offset, so large chunk addresses
belong there rather than in the coordinate fields.
This fixes Prison Architect corruption with 4096x4096 mipped textures
after they are evicted to GTT under memory pressure on RV530.
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/6716
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Pavel Ondračka <pavel.ondracka@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Wire up the newly parsed panel_type from drm_display_info into
amdgpu_dm's panel type detection path. When neither the AMD VSDB
nor DPCD determines the panel type, fall back to the DisplayID
Display Device Technology field to set PANEL_TYPE_LCD or
PANEL_TYPE_OLED accordingly. Also expose LCD to userspace via
the panel_type connector property.
Assisted-by: Copilot:Claude-Opus-4.6
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Parse the Display Parameters Data Block (tag 0x21) defined in
DisplayID v2.1a Section 4.2.6. Extract the Display Device Technology
field from the color depth and device technology byte, which indicates
whether the panel uses LCD or OLED technology.
Add a panel_type field to struct drm_display_info and populate it
during DisplayID iteration so downstream drivers can use it for
panel-type-dependent behavior. Add DRM_MODE_PANEL_TYPE_LCD to the UAPI
panel type property alongside the existing OLED value.
Assisted-by: Copilot:Claude-Opus-4.6
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Extract the DisplayID base section header logging and non_desktop
detection from update_displayid_info() into a dedicated helper,
drm_displayid_process_base_section_header(). Remove the break so the
iterator walks through all data blocks, preparing for future patches
that will parse additional block types within the loop.
The helper is called only once for the base section via a
base_section_header_processed flag. Since version and primary_use are
only captured from the base section, and extension sections carry a
primary use of zero per spec, the non_desktop logic is unaffected.
No functional change.
Assisted-by: Copilot:Claude-Opus-4.6
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This adds gfx 12.0 queue reset support to KFD topology.
Signed-off-by: Amber Lin <Amber.Lin@amd.com>
Reviewed-by: Jesse Zhang <jesse.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This patch adds the inclusion of gfx12.0.1 by checking GC's major number
and minor number equal to 12.0.* with the same mes_sched version.
Signed-off-by: Amber Lin <Amber.Lin@amd.com>
Reviewed-by: Jesse Zhang <jesse.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Kernel parameter `no_console_suspend` is required to capture all
hibernation kernel log via serial console. But when the parameter
is set, GPU will be resumed in thaw stage. This causes many issues
on alinux3 kernel.
Fix: add new debug mask `AMDGPU_DEBUG_HIBERNATION_THAW_RESUME_GPU` to
replace the check of `console_suspend_enabled` in thaw() callback.
User can enable it using `amdgpu.debug_mask=0x800`.
Signed-off-by: Samuel Zhang <guoqing.zhang@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
MES process context is a process-level page
where process specific context is saved for
MES scheduler.
However, current user-queue code path assigns
fw_obj of a queue to MES process_context_addr
when adding the queue to MES.
This means every new queue from the same process
would replace the previous process context address
with that queue's fw_obj address.
What's worse is, when user space frees a queue,
its fw_obj will be freed as well, causing MES
working on a NULL page pointer.
This issue leads to inconsistency and crash
in the scheduler.
This commit allocates a process-level page for
MES process contexts for a process other than queue-level
Signed-off-by: Zhu Lingshan <lingshan.zhu@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This patch enables queue reset support to KFD topology for gfx11 dGPUs
Signed-off-by: Amber Lin <Amber.Lin@amd.com>
Reviewed-by: Jesse Zhang <jesse.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Add estimate of how much vram we need to reserve for RAS
when caculating the total available vram
Signed-off-by: Ce Sun <cesun102@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
With the KFD_MMAP_TYPE_EVENTS mmap path gone, a kernel-allocated signal
page can no longer be exposed to user space, so allocate_signal_page()
and the related bookkeeping are dead code. The only remaining way to set
up a signal page is kfd_kmap_event_page()/kfd_event_page_set(), where
user space allocates the events page as a BO and passes it via the
event_page_offset of the create event IOCTL.
Remove allocate_signal_page() and require the signal page to be provided
by user space. Drop the now unused kfd_signal_page user mapping
bookkeeping (user_address/need_to_free_pages) and
kfd_event::user_signal_address.
Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
The rascore EEPROM runtime append path updates the saved bad page
count in memory and EEPROM. Keep the SMU bad page count in sync when
the EEPROM header is updated so firmware sees the latest count from
the runtime threshold path.
Notify UPDATE_BAD_PAGE_NUM after computing the rascore UMC bad page
count.
Signed-off-by: Xiang Liu <xiang.liu@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[Why]
amdgpu_dm_crtc_mem_type_changed() fetches the "old" and "new" plane state
with two drm_atomic_get_plane_state() calls, which both return the new
state. It compares a state against itself, so it never detects a mem_type
change and never rejects the async flip.
On DCN 3.0.1, this shows up as intermittent corruption when a single DCC
plane is scanned out with immediate flips under gamescope and its buffer
moves between the VRAM carveout and GTT.
[How]
Use drm_atomic_get_old_plane_state() and drm_atomic_get_new_plane_state()
to compare the actual old and new states. These return NULL rather than
an error pointer for a plane that is not part of the commit, so the
IS_ERR() check becomes a NULL check that skips those planes, such as an
unmodified cursor still in the CRTC's plane_mask.
Fixes: 4caacd1671 ("drm/amd/display: Do not elevate mem_type change to full update")
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
The mmap of the events (signal) page from /dev/kfd via
KFD_MMAP_TYPE_EVENTS was only needed on APUs using IOMMUv2, which is no
longer supported by the kernel mode driver. For dGPUs (and modern APUs)
the events page is allocated in user mode and mapped to the kernel
through the event_page_offset of the create event IOCTL
(kfd_kmap_event_page), so the KFD_MMAP_TYPE_EVENTS mmap path is no longer
functional.
Remove kfd_event_mmap() and reject KFD_MMAP_TYPE_EVENTS in kfd_mmap,
similar to the recent removal of KFD_MMAP_TYPE_RESERVED_MEM. This also
removes a way for user space to abuse KFD_MMAP_TYPE_EVENTS of kfd_mmap.
Signed-off-by: Yongqiang Sun <Yongqiang.Sun@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[Why]
The DRM core exposes an IN_FORMATS_ASYNC plane property describing the
set of format/modifier pairs that are valid for asynchronous (immediate)
page flips. amdgpu already advertises async page flip support via
mode_config.async_page_flip = true, but never implemented the
.format_mod_supported_async plane callback, so the IN_FORMATS_ASYNC
property was not created.
This inconsistency (advertising async flips while exposing IN_FORMATS but
no IN_FORMATS_ASYNC) causes userspace, such as igt-gpu-tools, to emit a
repeated warning during plane initialization, which in turn demotes many
otherwise passing KMS subtests to a WARN result.
[How]
Wire up .format_mod_supported_async to the existing
amdgpu_dm_plane_format_mod_supported callback so the async format list is
populated. amdgpu does not restrict async flips at the format/modifier
level: the async flip constraints are enforced at atomic check and commit
time and only require a fast update (no change to FB pitch, DCC state,
rotation or memory type) between the old and new buffers. Therefore the
set of formats/modifiers valid for async flips is identical to the
regular IN_FORMATS set, and the same callback can be reused.
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: James Lin <PingLei.Lin@amd.com>
Signed-off-by: Ivan Lipski <ivan.lipski@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This version brings along the following updates:
- Increase dcn42b uclk value.
- Add a new interface to set idle opts in clock manager.
- Revert dmub_cmd updates for HDMI.
- Add utm_qos_model pointer to clk_bw_params.
- Remove get_utm_qos_model from soc_and_ip_translator.
- Rename hdmi_frl_borrow_mode.
- Remove unused project_id from DML2 core instance.
- Drop HDMI2_1 guards.
- Introduce dc_plane_cm and migrate surface update color path.
- Extract backlight code to amdgpu_dm_backlight.
- Extract audio code to amdgpu_dm_audio.
- Extract DMUB code to amdgpu_dm_dmub.
- Move HPD and IRQ handler code to amdgpu_dm_irq.
- Extract connector and encoder code to amdgpu_dm_connector.
- Fix conflicting types for dc_plane_cm functions.
- Add PSR Active VTotal Control capability.
- Enable pstate for DCN4 non-emulation builds.
- Refactor surface_update_flags to flat struct with helpers.
- Add support for HDMI Compliance Automation.
- Add KUnit tests for amdgpu_dm and its components.
- Set default backlight without ACPI support.
- Move backlight macros to backlight header.
- Revert use of handle_hpd_irq_helper for HPD RX.
- FW Promotion Release 0.1.63.0.
Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[Why & How]
Add some CACP command and remove some unused struct and enum.
Signed-off-by: Taimur Hassan <Syed.Hassan@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This reverts commit 60597d2cb2.
Reason for revert: This change is found to cause hang on DP2 link layer compliance 4.2.2.8.
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Reviewed-by: Jerry Zuo <jerry.zuo@amd.com>
Tested-by: Mark Broadworth <mark.broadworth@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[WHAT]
Move AMDGPU_DM_DEFAULT_MIN_BACKLIGHT, AMDGPU_DM_DEFAULT_MAX_BACKLIGHT,
AMDGPU_DM_MIN_SPREAD, and AUX_BL_DEFAULT_TRANSITION_TIME_MS from
amdgpu_dm_backlight.c to amdgpu_dm_backlight.h so they can be reused
by KUnit tests. Update the test file to use these macros instead of
hardcoded literal values.
Assisted-by: Copilot:Claude-Opus-4.6
Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[Why]
If BIOS doesn't include ATIF method it will not specify default AC or DC
levels. This means that backlight will always start at 0%, which isn't
expected behavior.
[How]
Set default AC and DC level when no valid caps found. Also reduce code
duplication for ACPI and non-ACPI cases.
Reported-by: Edson Juliano Drosdeck <edson.drosdeck@gmail.com>
Closes: https://lore.kernel.org/dri-devel/20260526210048.1162477-1-edson.drosdeck@gmail.com/
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
The following existing functions are also exported for the test module:
- needs_dsc_aux_workaround: detect branches needing the DSC AUX workaround
- dm_mst_get_pbn_divider: compute the PBN divider from link bandwidth
- amdgpu_dm_mst_reset_mst_connector_setting: reset per-connector MST state
- retrieve_downstream_port_device: read downstream port presence from DPCD
- retrieve_branch_specific_data: read branch OUI from the upstream device
Several self-contained pieces of logic are extracted from larger functions
into small testable helpers.
- dm_dp_aux_transfer_result: AUX return-code to errno mapping
- dm_dp_aux_fill_payload_flags: AUX request bit decode
- dm_mst_msg_ready_mask: MST sideband ESI mask selection
- dm_mst_select_esi_dpcd: DPCD ESI address/length selection
Assisted-by: Copilot:Claude-Opus-4.6
Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Expand KUnit coverage of amdgpu_dm_pp_smu.c and extract several pure
translation helpers so they can be unit tested in isolation.
Extract pure logic into testable helpers:
- build_pm_display_cfg() from dm_pp_apply_display_requirements()
- build_wm_clock_ranges_soc15() from pp_rv_set_wm_ranges()
- cap_clock_levels_to_validation() from dm_pp_get_clock_levels_by_type()
- pp_smu_nv_clock_id_to_pp() from pp_nv_set_voltage_by_freq()
Tests cover:
- pp_to_dc_clock_levels: within-limit copy and count capping
- pp_to_dc_clock_levels_with_latency: field copy and count capping
- pp_to_dc_clock_levels_with_voltage: field copy and count capping
- dm_pp_get_funcs: RV, RV 1.01, NV, RN, and unsupported versions
- dm_pp_apply_display_requirements: DPM-disabled early-return path
- dm_pp_apply_clock_for_voltage_request: invalid clock type path
- build_pm_display_cfg: scalar field scaling and per-display mapping
- build_wm_clock_ranges_soc15: DMIF and MCIF range translation
- cap_clock_levels_to_validation: engine/memory capping and floor
- pp_smu_nv_clock_id_to_pp: valid ids and invalid-id rejection
Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Add KUnit test file amdgpu_dm_quirks_test.c covering retrieve_dmi_info().
Three test cases are provided:
- Verify aux_hpd_discon_quirk is reset to false even when previously true
- Verify edp0_on_dp1_quirk is reset to false even when previously true
- Verify both quirks remain false on a zero-initialised dm when no
DMI match is found (expected in UML/KUnit environment)
Register the new test object in the tests/Makefile under
CONFIG_DRM_AMD_DC_KUNIT_TEST.
Assisted-by: Copilot:Claude-Sonnet-4.6
Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Add amdgpu_dm_helpers_test.c with 32 KUnit test cases covering the
following functions in amdgpu_dm_helpers.c:
- edid_extract_panel_id(): basic extraction with known mfg_id and
prod_code; zero inputs produce zero output.
- dm_is_freesync_pcon_whitelist(): every entry in the whitelist
table returns true; an unknown ID and a zero ID return false.
- populate_hdmi_info_from_connector(): scdc_present is copied from
hdmi->scdc.supported for both true and false; FRL DSC fields map
10bpc and 12bpc correctly and ignore unknown values.
- dm_get_adaptive_sync_support_type(): five cases covering the
default non-converter path, HDMI converter without conditions,
partial conditions, all conditions met with a whitelist device
(FREESYNC_TYPE_PCON_IN_WHITELIST), and all conditions met with a
non-whitelisted device.
- dm_helpers_is_fullscreen() / dm_helpers_is_hdr_on(): stubs always
return false.
- get_max_frl_rate(): all six valid lane/rate combinations plus the
unknown combination returning 0.
- dm_dtn_log_begin()/dm_dtn_log_append_v()/dm_dtn_log_end(): buffer
accumulation and NULL-context handling without crashing.
- dm_helpers_dp_read_dpcd()/dm_helpers_dp_write_dpcd(): NULL link
private data returns false.
- dm_helpers_dp_mst_start_top_mgr()/dm_helpers_dp_mst_stop_top_mgr():
NULL link private data and the boot path.
- dm_helpers_dp_write_hblank_reduction(): stub returns false.
Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Add amdgpu_dm_services_test.c with KUnit coverage for five
functions in amdgpu_dm_services.c:
- dm_get_elapse_time_in_ns(): four arithmetic cases covering
zero delta, positive delta, ULLONG_MAX span, and unsigned
wraparound.
- dm_perf_trace_timestamp(): one case verifying the function
dereferences ctx->perf_trace safely (the tracepoint is a
no-op without an attached probe).
- dm_trace_smu_enter(): two cases for the empty stub with NULL
ctx and with non-zero parameters.
- dm_trace_smu_exit(): three cases for the empty stub covering
success, failure, and a non-zero response value.
- dm_query_extended_brightness_caps(): four guard-clause cases
(NULL ctx, NULL caps, NULL ctx->driver_context, NULL ctx with
LCD2) plus two success cases covering the LCD1 slot with
luminance data copy and a non-LCD1 display using the second
backlight slot with zero data points.
Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Add KUnit coverage for functions in amdgpu_dm_crtc.c:
- amdgpu_dm_crtc_modeset_required: verify active+needs_modeset
combinations (mode_changed, active_changed, connectors_changed)
- amdgpu_dm_crtc_vrr_active_irq: verify all VRR state enum values
- amdgpu_dm_crtc_vrr_active: verify all VRR state enum values
- amdgpu_dm_is_headless: null adev, no connectors, writeback-only,
disconnected display, connected display, and mixed connector cases
- amdgpu_dm_crtc_helper_mode_fixup: verify it accepts the mode
- amdgpu_dm_crtc_set_vupdate_irq: verify the otg_inst == -1 early
return using a DRM mock device
- idle_create_workqueue: verify the idle workqueue is allocated and
initialized in a disabled, non-running state
Assisted-by: Copilot:Claude-Opus-4.8
Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Add KUnit tests for helper functions, IRQ table management paths, and
DRM mock-backed CRTC lookup in amdgpu_dm_irq.c.
Tests cover:
- amdgpu_dm_hpd_to_dal_irq_source(): all HPD types 1-6,
AMDGPU_HPD_NONE, and out-of-range values
- are_sinks_equal(): NULL inputs, signal mismatch, EDID
length mismatch, EDID data mismatch, identical sinks,
zero-length EDID, full-length identical EDID, and a
single trailing-byte difference
- dmub_notification_type_str(): notification type mappings that are
always built, plus the unknown/default case
- amdgpu_dm_irq_init(): low/high handler list initialization
- amdgpu_dm_irq_register_interrupt(): NULL input rejection,
invalid context/source rejection, low/high handler insertion,
multiple handlers on one source, and the same handler registered
in both low and high contexts
- amdgpu_dm_irq_unregister_interrupt(): invalid source and NULL
handler rejection, removal of registered low/high handlers, and
the handler-not-found path
- amdgpu_dm_irq_fini(): cleanup of registered low/high handlers and
the empty-table case
- amdgpu_dm_get_crtc_by_otg_inst(): DRM mock CRTC list match,
no-match, and empty-list paths
Assisted-by: Copilot:Claude-Opus-4
Reviewed-by: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Chenyu Chen <chen-yu.chen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
