Merge tag 'drm-fixes-2026-09-26' of https://gitlab.freedesktop.org/drm/kernel

6812ce4e · Linus Torvalds <[email protected]> · 2026-09-25 16:00:18 -07:00

Pull drm fixes from Dave Airlie:
 "While most of this is AI inspired fixes for error handling paths,
  leaks and use after frees, there are some normal things.

  nouveau has probably the biggest changes with some fixes to stabilise
  runtime suspend/resume on 570 firmware which regressed after we moved
  from 535, there are some fixes to stackframe issues seen with amdgpu,
  and otherwise the usual bunch of i915/xe/amdgpu fixes, and some
  virtio-gpu fixes.

  Hopefully it will start to quiten down a bit from here.

  client:
   - fix restore of partially initialized client

  i915:
   - Fix incorrect RCU teardown order leading to endless loop
   - Fix DP MST TU and FEC handling for disconnected streams
   - Fix selective fetch disable, again
   - Fix export namespace for kunit helpers
   - Workaround eDP flicker on a specific laptop model

  xe:
   - CRI throttle reasons report
   - TLB invalidation at wedge
   - SVM eviction and VM close
   - Display corruption on LNL on Xen PV
   - W/a fix and addition

  amdgpu:
   - Display ref count fix
   - Userq fixes
   - VCN 4, 5 reset fixes
   - Fixes for various error paths
   - Stack frame size fixes for various combinations of compilers and
     configs

  amdkfd:
   - Possible UAF fix

  nouveau:
   - runtime suspend/resume fixes for newer firmware
   - rcu free the scheduler
   - fix VRAM pinning
   - fix double free
   - fix reference leaks
   - fix runtime PM leak
   - fix cursor list usage problems
   - fix HDMI config rejection without SCDC

  virtio:
   - fix a bunch of object/memory leaks in failure paths
   - add pixel blend mode property to cursor plane
   - revert prime buffers import
   - sync shmem backing on guest transfers

  imagination:
   - propogate map failures properly
   - fix page count in map interface
   - clamp freelist reconstruction requests

  ivpu:
   - use separate flag for job timeout

  bridge:
   - samsung-dsim: fix TE GPIO lifetime for host attach"

* tag 'drm-fixes-2026-09-26' of https://gitlab.freedesktop.org/drm/kernel: (60 commits)
  drm/amd/display: Bump frame warning limit for all builds of dml
  drm/imagination: clamp freelist reconstruction requests
  drm/imagination: Fix page count for page table for map() interface
  drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
  drm/amd/display: Bump frame warning limit for clang builds of dml
  drm/amd/display: Relax DML frame limit with UBSAN
  drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
  drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
  drm/amdgpu: Fix acpi device leak in amdgpu_acpi_enumerate_xcc()
  drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
  drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
  drm/amdgpu/vcn4.0.3: fix video_timeout unit mismatch in jpeg reset wait
  drm/amdgpu/vcn5.0.1: fix video_timeout unit mismatch in jpeg reset wait
  drm/amdgpu/userq: fix double jiffies conversion in hang detect timeout
  drm/amdgpu: move userq fence wait out of signalling section
  drm/amd/display: Fix dc stream excess put in dm_update_crtc_state()
  drm/xe: Add wa_14025941587 to xe2, xe3 and xe3p platforms
  drm/xe: harden adjust_idledly() against divide-by-zero and overflow
  drm/xe: Limit sg segment size to PAGE_SIZE on Xen PV
  drm/i915: fix incorrect RCU teardown order
  ...

Commit: 6812ce4e4379ffc99c52401ec28f0d7ffbc36206
Parents: 75467f60 · a9ed3aa9

Merge commit. Changes below are compared with the first parent: 75467f60.

Changes

79 files changed · +810 −135

File	Status	Add	Del	Content
drivers/accel/ivpu/ivpu_drv.c	modified	+2	−1	View file
drivers/accel/ivpu/ivpu_drv.h	modified	+1	−1	View file
drivers/accel/ivpu/ivpu_job.c	modified	+3	−4	View file
drivers/accel/ivpu/ivpu_mmu.c	modified	+0	−1	View file
drivers/accel/ivpu/ivpu_pm.c	modified	+1	−0	View file
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c	modified	+3	−1	View file
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c	modified	+3	−1	View file
drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c	modified	+3	−0	View file
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c	modified	+1	−1	View file
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c	modified	+7	−9	View file
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h	modified	+1	−0	View file
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c	modified	+1	−0	View file
drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c	modified	+2	−1	View file
drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c	modified	+2	−1	View file
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c	modified	+57	−14	View file
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c	modified	+3	−1	View file
drivers/gpu/drm/amd/display/dc/dml/Makefile	modified	+2	−2	View file
drivers/gpu/drm/amd/display/dc/dml2_0/Makefile	modified	+2	−2	View file
drivers/gpu/drm/bridge/samsung-dsim.c	modified	+1	−1	View file
drivers/gpu/drm/clients/drm_fbdev_client.c	modified	+8	−0	View file
drivers/gpu/drm/i915/display/intel_cursor.c	modified	+5	−2	View file
drivers/gpu/drm/i915/display/intel_display_types.h	modified	+2	−0	View file
drivers/gpu/drm/i915/display/intel_dp_link_caps.c	modified	+4	−2	View file
drivers/gpu/drm/i915/display/intel_dp_link_training.c	modified	+2	−2	View file
drivers/gpu/drm/i915/display/intel_dp_mst.c	modified	+23	−1	View file
drivers/gpu/drm/i915/display/intel_dp_mst.h	modified	+2	−0	View file
drivers/gpu/drm/i915/display/intel_link_bw.c	modified	+2	−1	View file
drivers/gpu/drm/i915/display/intel_psr.c	modified	+15	−0	View file
drivers/gpu/drm/i915/display/intel_quirks.c	modified	+3	−0	View file
drivers/gpu/drm/i915/display/skl_universal_plane.c	modified	+4	−5	View file
drivers/gpu/drm/i915/gem/i915_gem_object.c	modified	+1	−1	View file
drivers/gpu/drm/imagination/pvr_free_list.c	modified	+12	−3	View file
drivers/gpu/drm/imagination/pvr_mmu.c	modified	+12	−7	View file
drivers/gpu/drm/imagination/pvr_mmu.h	modified	+1	−1	View file
drivers/gpu/drm/imagination/pvr_vm.c	modified	+2	−2	View file
drivers/gpu/drm/nouveau/include/nvif/cl0080.h	modified	+10	−0	View file
drivers/gpu/drm/nouveau/include/nvif/device.h	modified	+1	−0	View file
drivers/gpu/drm/nouveau/include/nvkm/subdev/gsp.h	modified	+6	−0	View file
drivers/gpu/drm/nouveau/nouveau_bo.c	modified	+2	−1	View file
drivers/gpu/drm/nouveau/nouveau_connector.c	modified	+4	−1	View file
drivers/gpu/drm/nouveau/nouveau_dmem.c	modified	+2	−2	View file
drivers/gpu/drm/nouveau/nouveau_drm.c	modified	+15	−3	View file
drivers/gpu/drm/nouveau/nouveau_gem.c	modified	+2	−0	View file
drivers/gpu/drm/nouveau/nouveau_sched.c	modified	+1	−1	View file
drivers/gpu/drm/nouveau/nouveau_sched.h	modified	+1	−0	View file
drivers/gpu/drm/nouveau/nouveau_uvmm.c	modified	+11	−2	View file
drivers/gpu/drm/nouveau/nvif/device.c	modified	+13	−0	View file
drivers/gpu/drm/nouveau/nvif/vmm.c	modified	+1	−0	View file
drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c	modified	+7	−1	View file
drivers/gpu/drm/nouveau/nvkm/engine/device/user.c	modified	+35	−0	View file
drivers/gpu/drm/nouveau/nvkm/engine/disp/uoutp.c	modified	+1	−2	View file
drivers/gpu/drm/nouveau/nvkm/subdev/clk/base.c	modified	+21	−10	View file
drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramnv1a.c	modified	+2	−0	View file
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/base.c	modified	+10	−0	View file
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/priv.h	modified	+1	−0	View file
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c	modified	+17	−0	View file
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/nvrm/gsp.h	modified	+45	−0	View file
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c	modified	+75	−2	View file
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/gsp.c	modified	+36	−0	View file
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/nvrm/fbsr.h	modified	+29	−0	View file
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/nvrm/gsp.h	modified	+7	−0	View file
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/rm.h	modified	+3	−0	View file
drivers/gpu/drm/virtio/virtgpu_drv.h	modified	+5	−0	View file
drivers/gpu/drm/virtio/virtgpu_gem.c	modified	+1	−1	View file
drivers/gpu/drm/virtio/virtgpu_ioctl.c	modified	+46	−3	View file
drivers/gpu/drm/virtio/virtgpu_plane.c	modified	+13	−0	View file
drivers/gpu/drm/virtio/virtgpu_prime.c	modified	+1	−1	View file
drivers/gpu/drm/virtio/virtgpu_submit.c	modified	+9	−2	View file
drivers/gpu/drm/virtio/virtgpu_vq.c	modified	+46	−0	View file
drivers/gpu/drm/virtio/virtgpu_vram.c	modified	+9	−8	View file
drivers/gpu/drm/xe/regs/xe_gt_regs.h	modified	+1	−0	View file
drivers/gpu/drm/xe/xe_bo.c	modified	+7	−0	View file
drivers/gpu/drm/xe/xe_bo.h	modified	+19	−0	View file
drivers/gpu/drm/xe/xe_gt_throttle.c	modified	+3	−2	View file
drivers/gpu/drm/xe/xe_guc_ads.c	modified	+1	−1	View file
drivers/gpu/drm/xe/xe_hw_engine.c	modified	+85	−11	View file
drivers/gpu/drm/xe/xe_tlb_inval.c	modified	+2	−1	View file
drivers/gpu/drm/xe/xe_vm.c	modified	+9	−12	View file
drivers/gpu/drm/xe/xe_wa_oob.rules	modified	+2	−0	View file

Only the first 600 diff lines are shown. Download the complete patch.

drivers/accel/ivpu/ivpu_drv.c

View file

diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c
index 9512095..8c1c87e 100644
--- a/drivers/accel/ivpu/ivpu_drv.c
+++ b/drivers/accel/ivpu/ivpu_drv.c
@@ -515,6 +515,7 @@ void ivpu_prepare_for_reset(struct ivpu_device *vdev)
 {
 	ivpu_hw_irq_disable(vdev);
 	disable_irq(vdev->irq);
+	atomic_set(&vdev->job_timeout_detected, 0);
 	flush_work(&vdev->irq_dct_work);
 	flush_work(&vdev->context_abort_work);
 	flush_work(&vdev->job_destroy_work);
@@ -710,7 +711,7 @@ static int ivpu_dev_init(struct ivpu_device *vdev)
 	vdev->context_xa_limit.max = IVPU_USER_CONTEXT_MAX_SSID;
 	atomic64_set(&vdev->unique_id_counter, 0);
 	atomic_set(&vdev->job_timeout_counter, 0);
-	atomic_set(&vdev->faults_detected, 0);
+	atomic_set(&vdev->job_timeout_detected, 0);
 	xa_init_flags(&vdev->context_xa, XA_FLAGS_ALLOC | XA_FLAGS_LOCK_IRQ);
 	xa_init_flags(&vdev->submitted_jobs_xa, XA_FLAGS_ALLOC1);
 	xa_init_flags(&vdev->db_xa, XA_FLAGS_ALLOC1);

drivers/accel/ivpu/ivpu_drv.h

View file

diff --git a/drivers/accel/ivpu/ivpu_drv.h b/drivers/accel/ivpu/ivpu_drv.h
index 86d7c99..6f40129 100644
--- a/drivers/accel/ivpu/ivpu_drv.h
+++ b/drivers/accel/ivpu/ivpu_drv.h
@@ -171,7 +171,7 @@ struct ivpu_device {
 	struct xarray submitted_jobs_xa;
 	struct ivpu_ipc_consumer job_done_consumer;
 	atomic_t job_timeout_counter;
-	atomic_t faults_detected;
+	atomic_t job_timeout_detected;
 
 	atomic64_t unique_id_counter;
 

drivers/accel/ivpu/ivpu_job.c

View file

diff --git a/drivers/accel/ivpu/ivpu_job.c b/drivers/accel/ivpu/ivpu_job.c
index ebb2c86..4689b8a 100644
--- a/drivers/accel/ivpu/ivpu_job.c
+++ b/drivers/accel/ivpu/ivpu_job.c
@@ -621,7 +621,6 @@ bool ivpu_job_handle_engine_error(struct ivpu_device *vdev, u32 job_id, u32 job_
 		 * status and ensure both are handled in the same way
 		 */
 		job->file_priv->has_mmu_faults = true;
-		atomic_set(&vdev->faults_detected, 1);
 		queue_work(system_percpu_wq, &vdev->context_abort_work);
 		return true;
 	}
@@ -1175,10 +1174,10 @@ static int reset_engine_and_mark_faulty_contexts(struct ivpu_device *vdev)
 		return ret;
 
 	/*
-	 * If faults are detected, ignore guilty contexts from engine reset as NPU may not be stuck
-	 * and could return currently running good context and faulty contexts are already marked
+	 * If job timeout is detected, read guilty context from engine reset, for other reasons
+	 * faulty context is already known
 	 */
-	if (atomic_cmpxchg(&vdev->faults_detected, 1, 0) == 1)
+	if (atomic_cmpxchg(&vdev->job_timeout_detected, 1, 0) == 0)
 		return 0;
 
 	num_impacted_contexts = resp.payload.engine_reset_done.num_impacted_contexts;

drivers/accel/ivpu/ivpu_mmu.c

View file

diff --git a/drivers/accel/ivpu/ivpu_mmu.c b/drivers/accel/ivpu/ivpu_mmu.c
index 41efd89..b202527 100644
--- a/drivers/accel/ivpu/ivpu_mmu.c
+++ b/drivers/accel/ivpu/ivpu_mmu.c
@@ -964,7 +964,6 @@ void ivpu_mmu_irq_evtq_handler(struct ivpu_device *vdev)
 		file_priv = xa_load(&vdev->context_xa, ssid);
 		if (file_priv) {
 			if (!READ_ONCE(file_priv->has_mmu_faults)) {
-				atomic_set(&vdev->faults_detected, 1);
 				ivpu_mmu_dump_event(vdev, event);
 				WRITE_ONCE(file_priv->has_mmu_faults, true);
 			}

drivers/accel/ivpu/ivpu_pm.c

View file

diff --git a/drivers/accel/ivpu/ivpu_pm.c b/drivers/accel/ivpu/ivpu_pm.c
index c1ce832..de0becb 100644
--- a/drivers/accel/ivpu/ivpu_pm.c
+++ b/drivers/accel/ivpu/ivpu_pm.c
@@ -229,6 +229,7 @@ abort:
 
 	ivpu_jsm_state_dump(vdev);
 	ivpu_dev_coredump(vdev);
+	atomic_set(&vdev->job_timeout_detected, 1);
 	queue_work(system_percpu_wq, &vdev->context_abort_work);
 }
 

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c

View file

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 7f5abb0..8b8acf9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1167,8 +1167,10 @@ int amdgpu_acpi_enumerate_xcc(void)
 		}
 
 		xcc_info = kzalloc_obj(struct amdgpu_acpi_xcc_info);
-		if (!xcc_info)
+		if (!xcc_info) {
+			acpi_dev_put(acpi_dev);
 			return -ENOMEM;
+		}
 
 		INIT_LIST_HEAD(&xcc_info->list);
 		xcc_info->handle = acpi_device_handle(acpi_dev);

drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c

View file

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index 132d054..aca1a80 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -1780,8 +1780,10 @@ static int amdgpu_debugfs_test_ib_show(struct seq_file *m, void *unused)
 
 	/* Avoid accidently unparking the sched thread during GPU reset */
 	r = down_write_killable(&adev->reset_domain->sem);
-	if (r)
+	if (r) {
+		pm_runtime_put_autosuspend(dev->dev);
 		return r;
+	}
 
 	/* hold on the scheduler */
 	for (i = 0; i < AMDGPU_MAX_RINGS; i++) {

drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c

View file

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c
index f6b7522..f8652fd 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c
@@ -68,6 +68,9 @@ amdgpu_eviction_fence_suspend_worker(struct work_struct *work)
 
 	mutex_lock(&uq_mgr->userq_mutex);
 
+	/* Fence waits are not allowed in a fence signalling critical section. */
+	amdgpu_userq_wait_for_signal(uq_mgr);
+
 	/*
 	 * This is intentionally after taking the userq_mutex since we do
 	 * allocate memory while holding this lock, but only after ensuring that

drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c

View file

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index 686c92e..5922406 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -254,7 +254,6 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring,
 		ring->adev = adev;
 		ring->num_hw_submission = sched_hw_submission;
 		ring->sched_score = sched_score;
-		ring->vmid_wait = dma_fence_get_stub();
 
 		ring->idx = adev->num_rings++;
 		adev->rings[ring->idx] = ring;
@@ -374,6 +373,7 @@ int amdgpu_ring_init(struct amdgpu_device *adev, struct amdgpu_ring *ring,
 
 	ring->max_dw = max_dw;
 	ring->hw_prio = hw_prio;
+	ring->vmid_wait = dma_fence_get_stub();
 
 	if (!ring->no_scheduler && ring->funcs->type < AMDGPU_HW_IP_NUM) {
 		hw_ip = ring->funcs->type;

drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c

View file

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
index e43bda0..cc8e7af 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
@@ -184,27 +184,27 @@ static void amdgpu_userq_hang_detect_work(struct work_struct *work)
 void amdgpu_userq_start_hang_detect_work(struct amdgpu_usermode_queue *queue)
 {
 	struct amdgpu_device *adev;
-	unsigned long timeout_ms;
+	unsigned long timeout_jiffies;
 
 	adev = queue->userq_mgr->adev;
 	/* Determine timeout based on queue type */
 	switch (queue->queue_type) {
 	case AMDGPU_RING_TYPE_GFX:
-		timeout_ms = adev->gfx_timeout;
+		timeout_jiffies = adev->gfx_timeout;
 		break;
 	case AMDGPU_RING_TYPE_COMPUTE:
-		timeout_ms = adev->compute_timeout;
+		timeout_jiffies = adev->compute_timeout;
 		break;
 	case AMDGPU_RING_TYPE_SDMA:
-		timeout_ms = adev->sdma_timeout;
+		timeout_jiffies = adev->sdma_timeout;
 		break;
 	default:
-		timeout_ms = adev->gfx_timeout;
+		timeout_jiffies = adev->gfx_timeout;
 		break;
 	}
 
 	queue_delayed_work(adev->reset_domain->wq, &queue->hang_detect_work,
-			   msecs_to_jiffies(timeout_ms));
+			   timeout_jiffies);
 }
 
 void amdgpu_userq_process_fence_irq(struct amdgpu_device *adev, u32 doorbell)
@@ -1272,7 +1272,7 @@ amdgpu_userq_evict_all(struct amdgpu_userq_mgr *uq_mgr)
 	return ret;
 }
 
-static void
+void
 amdgpu_userq_wait_for_signal(struct amdgpu_userq_mgr *uq_mgr)
 {
 	struct amdgpu_usermode_queue *queue;
@@ -1291,8 +1291,6 @@ amdgpu_userq_wait_for_signal(struct amdgpu_userq_mgr *uq_mgr)
 void
 amdgpu_userq_evict(struct amdgpu_userq_mgr *uq_mgr)
 {
-	/* Wait for any pending userqueue fence work to finish */
-	amdgpu_userq_wait_for_signal(uq_mgr);
 	amdgpu_userq_evict_all(uq_mgr);
 }
 

drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h

View file

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
index 6412a7f..488dc21 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h
@@ -162,6 +162,7 @@ void amdgpu_userq_mgr_cancel_reset_work(struct amdgpu_device *adev);
 void amdgpu_userq_mgr_cancel_resume(struct amdgpu_userq_mgr *userq_mgr);
 void amdgpu_userq_mgr_fini(struct amdgpu_userq_mgr *userq_mgr);
 
+void amdgpu_userq_wait_for_signal(struct amdgpu_userq_mgr *uq_mgr);
 void amdgpu_userq_evict(struct amdgpu_userq_mgr *uq_mgr);
 
 void amdgpu_userq_ensure_ev_fence(struct amdgpu_userq_mgr *userq_mgr,

drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c

View file

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index bb04101..4a63b47 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -2678,6 +2678,7 @@ error_free_root:
 	amdgpu_bo_unref(&root_bo);
 
 error_free_delayed:
+	dma_fence_put(vm->last_update);
 	dma_fence_put(vm->last_tlb_flush);
 	dma_fence_put(vm->last_unlocked);
 	ttm_lru_bulk_move_fini(&adev->mman.bdev, &vm->lru_bulk_move);

drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c

View file

diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
index 179b892..62e2e04 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0_3.c
@@ -1689,7 +1689,8 @@ static int vcn_v4_0_3_reset_jpeg_pre_helper(struct amdgpu_device *adev, int inst
 		/* if Jobs are still pending after timeout,
 		 * We'll handle them in the bottom helper
 		 */
-		amdgpu_fence_wait_polling(ring, wait_seq, adev->video_timeout);
+		amdgpu_fence_wait_polling(ring, wait_seq,
+					  jiffies_to_usecs(adev->video_timeout));
        }
 
 	return 0;

drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c

View file

diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
index 1a07c3b..011afc0 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v5_0_1.c
@@ -1335,7 +1335,8 @@ static int vcn_v5_0_1_reset_jpeg_pre_helper(struct amdgpu_device *adev, int inst
 		/* if Jobs are still pending after timeout,
 		 * We'll handle them in the bottom helper
 		 */
-		amdgpu_fence_wait_polling(ring, wait_seq, adev->video_timeout);
+		amdgpu_fence_wait_polling(ring, wait_seq,
+					  jiffies_to_usecs(adev->video_timeout));
        }
 
 	return 0;

drivers/gpu/drm/amd/amdkfd/kfd_chardev.c

View file

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 504a286..344da6c 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -35,6 +35,7 @@
 #include <linux/time.h>
 #include <linux/mm.h>
 #include <linux/mman.h>
+#include <linux/pseudo_fs.h>
 #include <linux/ptrace.h>
 #include <linux/dma-buf.h>
 #include <linux/processor.h>
@@ -70,18 +71,54 @@ static const struct class kfd_class = {
 };
 
 /*
- * Cache the address space of the chardev on first open so that the reset
- * path can drop all userspace mappings of doorbell and MMIO ranges via
- * unmap_mapping_range().
+ * Private pseudo-filesystem for KFD, Provides a stable, module-owned
+ * inode whose address_space is the unmap target for all /dev/kfd
+ * openers during GPU reset.
  */
-static struct address_space *kfd_dev_mapping;
+static struct vfsmount *kfd_fs_mnt;
+static int kfd_fs_cnt;
 
-void kfd_dev_unmap_mapping_range(loff_t const holebegin, loff_t const holelen)
+static int kfd_fs_init_fs_context(struct fs_context *fc)
+{
+	return init_pseudo(fc, 0x4b464400 /* "KFD" */) ? 0 : -ENOMEM;
+}
+
+static struct file_system_type kfd_fs_type = {
+	.name		= "kfd",
+	.init_fs_context = kfd_fs_init_fs_context,
+	.kill_sb	= kill_anon_super,
+};
+
+static struct inode *kfd_fs_inode_new(void)
 {
-	struct address_space *mapping = READ_ONCE(kfd_dev_mapping);
+	struct inode *inode;
+	int r;
+
+	r = simple_pin_fs(&kfd_fs_type, &kfd_fs_mnt, &kfd_fs_cnt);
+	if (r < 0)
+		return ERR_PTR(r);
+
+	inode = alloc_anon_inode(kfd_fs_mnt->mnt_sb);
+	if (IS_ERR(inode))
+		simple_release_fs(&kfd_fs_mnt, &kfd_fs_cnt);
 
-	if (mapping)
-		unmap_mapping_range(mapping, holebegin, holelen, 1);
+	return inode;
+}
+
+static void kfd_fs_inode_free(struct inode *inode)
+{
+	if (inode) {
+		iput(inode);
+		simple_release_fs(&kfd_fs_mnt, &kfd_fs_cnt);
+	}
+}
+
+static struct inode *kfd_anon_inode;
+
+void kfd_dev_unmap_mapping_range(loff_t const holebegin, loff_t const holelen)
+{
+	if (kfd_anon_inode)
+		unmap_mapping_range(kfd_anon_inode->i_mapping, holebegin, holelen, 1);
 }
 
 static inline struct kfd_process_device *kfd_lock_pdd_by_id(struct kfd_process *p, __u32 gpu_id)
@@ -107,6 +144,13 @@ int kfd_chardev_init(void)
 {
 	int err = 0;
 
+	kfd_anon_inode = kfd_fs_inode_new();
+	if (IS_ERR(kfd_anon_inode)) {
+		err = PTR_ERR(kfd_anon_inode);
+		kfd_anon_inode = NULL;
+		return err;
+	}
+
 	kfd_char_dev_major = register_chrdev(0, kfd_dev_name, &kfd_fops);
 	err = kfd_char_dev_major;
 	if (err < 0)
@@ -130,6 +174,8 @@ err_device_create:
 err_class_create:
 	unregister_chrdev(kfd_char_dev_major, kfd_dev_name);
 err_register_chrdev:
+	kfd_fs_inode_free(kfd_anon_inode);
+	kfd_anon_inode = NULL;
 	return err;
 }
 
@@ -138,6 +184,8 @@ void kfd_chardev_exit(void)
 	device_destroy(&kfd_class, MKDEV(kfd_char_dev_major, 0));
 	class_unregister(&kfd_class);
 	unregister_chrdev(kfd_char_dev_major, kfd_dev_name);
+	kfd_fs_inode_free(kfd_anon_inode);
+	kfd_anon_inode = NULL;
 	kfd_device = NULL;
 }
 
@@ -150,12 +198,7 @@ static int kfd_open(struct inode *inode, struct file *filep)
 	if (iminor(inode) != 0)
 		return -ENODEV;
 
-	/*
-	 * /dev/kfd is a single chardev so all opens share one inode. Cache
-	 * its address_space on the first open for use by the reset path.
-	 */
-	if (!READ_ONCE(kfd_dev_mapping))
-		cmpxchg(&kfd_dev_mapping, NULL, inode->i_mapping);
+	filep->f_mapping = kfd_anon_inode->i_mapping;
 
 	is_32bit_user_mode = in_compat_syscall();
 

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c

View file

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 36d2f86..91fdf3d 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5583,8 +5583,10 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
 
 skip_modeset:
 	/* Release extra reference */
-	if (new_stream)
+	if (new_stream) {
 		dc_stream_release(new_stream);
+		new_stream = NULL;
+	}
 	new_stream = NULL;
 
 	/*

drivers/gpu/drm/amd/display/dc/dml/Makefile

View file

diff --git a/drivers/gpu/drm/amd/display/dc/dml/Makefile b/drivers/gpu/drm/amd/display/dc/dml/Makefile
index 10d4ace..91465ac 100644
--- a/drivers/gpu/drm/amd/display/dc/dml/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dml/Makefile
@@ -29,14 +29,14 @@ dml_ccflags := $(CC_FLAGS_FPU)
 dml_rcflags := $(CC_FLAGS_NO_FPU)
 
 ifneq ($(CONFIG_FRAME_WARN),0)
-    ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)
+    ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)$(CONFIG_UBSAN)),y)
         ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_COMPILE_TEST),yy)
             frame_warn_limit := 4096
         else
             frame_warn_limit := 3072
         endif
     else
-        frame_warn_limit := 2048
+	frame_warn_limit := 3072
     endif
 
     ifeq ($(call test-lt, $(CONFIG_FRAME_WARN), $(frame_warn_limit)),y)

drivers/gpu/drm/amd/display/dc/dml2_0/Makefile

View file

diff --git a/drivers/gpu/drm/amd/display/dc/dml2_0/Makefile b/drivers/gpu/drm/amd/display/dc/dml2_0/Makefile
index 5388bf0..39ee2d1 100644
--- a/drivers/gpu/drm/amd/display/dc/dml2_0/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dml2_0/Makefile
@@ -28,14 +28,14 @@ dml2_ccflags := $(CC_FLAGS_FPU)
 dml2_rcflags := $(CC_FLAGS_NO_FPU)
 
 ifneq ($(CONFIG_FRAME_WARN),0)
-    ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)),y)
+    ifeq ($(filter y,$(CONFIG_KASAN)$(CONFIG_KCSAN)$(CONFIG_UBSAN)),y)
         ifeq ($(CONFIG_CC_IS_CLANG)$(CONFIG_COMPILE_TEST),yy)
             frame_warn_limit := 4096
         else
             frame_warn_limit := 3072
         endif
     else
-        frame_warn_limit := 2056
+        frame_warn_limit := 3072
     endif
 
     ifeq ($(call test-lt, $(CONFIG_FRAME_WARN), $(frame_warn_limit)),y)

drivers/gpu/drm/bridge/samsung-dsim.c

View file

diff --git a/drivers/gpu/drm/bridge/samsung-dsim.c b/drivers/gpu/drm/bridge/samsung-dsim.c
index e2fc69f..4694241 100644
--- a/drivers/gpu/drm/bridge/samsung-dsim.c
+++ b/drivers/gpu/drm/bridge/samsung-dsim.c
@@ -1862,7 +1862,7 @@ static int samsung_dsim_register_te_irq(struct samsung_dsim *dsi, struct device 
 	int te_gpio_irq;
 	int ret;
 
-	dsi->te_gpio = devm_gpiod_get_optional(dev, "te", GPIOD_IN);
+	dsi->te_gpio = gpiod_get_optional(dev, "te", GPIOD_IN);
 	if (!dsi->te_gpio)
 		return 0;
 	else if (IS_ERR(dsi->te_gpio))

drivers/gpu/drm/clients/drm_fbdev_client.c

View file

diff --git a/drivers/gpu/drm/clients/drm_fbdev_client.c b/drivers/gpu/drm/clients/drm_fbdev_client.c
index 91d196a..1c16bc1 100644
--- a/drivers/gpu/drm/clients/drm_fbdev_client.c
+++ b/drivers/gpu/drm/clients/drm_fbdev_client.c
@@ -42,6 +42,14 @@ static int drm_fbdev_client_restore(struct drm_client_dev *client, bool force)
 {
 	struct drm_fb_helper *fb_helper = drm_fb_helper_from_client(client);
 
+	/*
+	 * The client is registered before the initial fbdev probe.
+	 * If probing failed, the client remains registered but there
+	 * is no valid fbdev framebuffer to restore.
+	 */
+	if (!fb_helper->info || !fb_helper->fb)
+		return 0;
+
 	drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper, force);
 
 	return 0;

drivers/gpu/drm/i915/display/intel_cursor.c

View file

diff --git a/drivers/gpu/drm/i915/display/intel_cursor.c b/drivers/gpu/drm/i915/display/intel_cursor.c
index 0673f16..824ffee 100644
--- a/drivers/gpu/drm/i915/display/intel_cursor.c
+++ b/drivers/gpu/drm/i915/display/intel_cursor.c
@@ -536,7 +536,8 @@ static void i9xx_cursor_disable_sel_fetch_arm(struct intel_dsb *dsb,
 	struct intel_display *display = to_intel_display(plane);
 	enum pipe pipe = plane->pipe;
 
-	if (!crtc_state->enable_psr2_sel_fetch)
+	if (!crtc_state->enable_psr2_sel_fetch &&
+	    !crtc_state->clear_psr2_sel_fetch)
 		return;
 
 	intel_de_write_dsb(display, dsb, SEL_FETCH_CUR_CTL(pipe), 0);
@@ -569,8 +570,10 @@ static void i9xx_cursor_update_sel_fetch_arm(struct intel_dsb *dsb,
 	struct intel_display *display = to_intel_display(plane);
 	enum pipe pipe = plane->pipe;
 
-	if (!crtc_state->enable_psr2_sel_fetch)
+	if (!crtc_state->enable_psr2_sel_fetch) {
+		i9xx_cursor_disable_sel_fetch_arm(dsb, plane, crtc_state);
 		return;
+	}
 
 	if (drm_rect_height(&plane_state->psr2_sel_fetch_area) > 0) {
 		if (crtc_state->enable_psr2_su_region_et) {

drivers/gpu/drm/i915/display/intel_display_types.h

View file

diff --git a/drivers/gpu/drm/i915/display/intel_display_types.h b/drivers/gpu/drm/i915/display/intel_display_types.h
index 43d53a9..f6a9b0d 100644
--- a/drivers/gpu/drm/i915/display/intel_display_types.h
+++ b/drivers/gpu/drm/i915/display/intel_display_types.h
@@ -1187,6 +1187,8 @@ struct intel_crtc_state {
 	bool has_sel_update;
 	bool enable_psr2_sel_fetch;
 	bool enable_psr2_su_region_et;
+	/* Drop the stale selective fetch enable bits as selective fetch is turned off */
+	bool clear_psr2_sel_fetch;
 	bool req_psr2_sdp_prior_scanline;
 	bool has_panel_replay;
 	bool link_off_after_as_sdp_when_pr_active;

drivers/gpu/drm/i915/display/intel_dp_link_caps.c

View file

diff --git a/drivers/gpu/drm/i915/display/intel_dp_link_caps.c b/drivers/gpu/drm/i915/display/intel_dp_link_caps.c
index 98657aa..abec3e2 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_link_caps.c
+++ b/drivers/gpu/drm/i915/display/intel_dp_link_caps.c
@@ -3,6 +3,8 @@
  * Copyright © 2026 Intel Corporation
  */
 
+#include <kunit/visibility.h>
+
 #include <linux/bitops.h>
 #include <linux/debugfs.h>
 #include <linux/log2.h>
@@ -1302,14 +1304,14 @@ void intel_dp_link_caps_cleanup(struct intel_dp_link_caps *link_caps)
 const struct intel_dp_link_caps_test_ops i915_display_dp_link_caps_test_ops = {
 	INTEL_DP_LINK_CAPS_TEST_OPS_INIT
 };
-EXPORT_SYMBOL(i915_display_dp_link_caps_test_ops);
+EXPORT_SYMBOL_IF_KUNIT(i915_display_dp_link_caps_test_ops);
 
 #else
 
 const struct intel_dp_link_caps_test_ops intel_display_dp_link_caps_test_ops = {
 	INTEL_DP_LINK_CAPS_TEST_OPS_INIT
 };
-EXPORT_SYMBOL(intel_display_dp_link_caps_test_ops);
+EXPORT_SYMBOL_IF_KUNIT(intel_display_dp_link_caps_test_ops);
 
 #endif	/* I915 */
 

drivers/gpu/drm/i915/display/intel_dp_link_training.c

View file

diff --git a/drivers/gpu/drm/i915/display/intel_dp_link_training.c b/drivers/gpu/drm/i915/display/intel_dp_link_training.c
index cb92cff..9a692f4 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_link_training.c
+++ b/drivers/gpu/drm/i915/display/intel_dp_link_training.c
@@ -2825,14 +2825,14 @@ void intel_dp_link_training_cleanup(struct intel_dp_link_training *link_training
 const struct intel_dp_link_training_test_ops i915_display_dp_link_training_test_ops = {
 	INTEL_DP_LINK_TRAINING_TEST_OPS_INIT
 };
-EXPORT_SYMBOL(i915_display_dp_link_training_test_ops);
+EXPORT_SYMBOL_IF_KUNIT(i915_display_dp_link_training_test_ops);
 
 #else
 
 const struct intel_dp_link_training_test_ops intel_display_dp_link_training_test_ops = {
 	INTEL_DP_LINK_TRAINING_TEST_OPS_INIT
 };
-EXPORT_SYMBOL(intel_display_dp_link_training_test_ops);
+EXPORT_SYMBOL_IF_KUNIT(intel_display_dp_link_training_test_ops);
 
 #endif	/* I915 */
 

drivers/gpu/drm/i915/display/intel_dp_mst.c

View file

diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c
index 57daed0..fb3942f 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_mst.c
+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c
@@ -852,7 +852,8 @@ static u8 get_pipes_downstream_of_mst_port(struct intel_atomic_state *state,
 		if (&connector->mst.dp->mst.mgr != mst_mgr)
 			continue;
 
-		if (connector->mst.port != parent_port &&
+		if (parent_port &&
+		    connector->mst.port != parent_port &&
 		    !drm_dp_mst_port_downstream_of_parent(mst_mgr,
 							  connector->mst.port,
 							  parent_port))
@@ -2167,6 +2168,27 @@ bool intel_dp_mst_crtc_needs_modeset(struct intel_atomic_state *state,
 	return false;
 }
 
+bool intel_dp_mst_stream_disconnected(struct intel_atomic_state *state,
+				      const struct intel_crtc *crtc)
+{
+	struct intel_connector *connector;
+
+	connector = get_connector_in_state_for_crtc(state, crtc);
+	if (!connector)
+		return false;
+
+	if (!connector->mst.dp)
+		return false;
+
+	if (!connector->mst.dp->mst.mgr.mst_state)
+		return true;
+
+	if (drm_connector_is_unregistered(&connector->base))
+		return true;
+
+	return false;
+}
+
 /**
  * intel_dp_mst_prepare_probe - Prepare an MST link for topology probing