summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2 daysMerge tag 'media/v7.4-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - v4l2 core: - improve subdev and pixformat kAPI; - fix P010 format info and add Y12 format info; - add fwnode_graph_for_each_endpoint_scoped(); - New sensor drivers: - Sony IMX576 - OmniVision OS02G10, OV05C10 and OG0VA1B - Samsung S5KJN5 - Himax HM1246 - Maxim GMSL2/3: add support for MAX9296A, MAX96717, and MAX96724 - Intel IPU6: add support for IPU7, IPU7.5 and IPU8 - NXP: add support for i.MX95 CSI pixel formatter driver - ITE: add driver for IT6625/IT6626 HDMI bridge - Qualcomm: add CSI2 3ph DPHY driver - Rockchip: add rk3576 MIPI capture vicap driver - STM32 DCMIPP: Add STM32MP25 subdevices - Lots of driver fixes and cleanups * tag 'media/v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (596 commits) media: i2c: imx576: Fix line length register media: ov05c10: Remove duplicated writes to analogue gain register media: ov05c10: Power management fixes media: ov05c10: Set reset GPIO high when acquiring it media: ov05c10: Small cleanups media: maxim-serdes: Disable test pattern generator for now media: mc: Keep INTERNAL pad flags just for the kernel, for now media: i2c: imx576: select VIDEO_CCS_PLL to repair build error media: Documentation: mc: Fix Stream reference media: i2c: add imx576 image sensor driver dt-bindings: media: i2c: Add imx576 sensor media: i2c: maxim-serdes: add MAX9296A driver media: i2c: remove MAX96714 driver media: i2c: maxim-serdes: add MAX96724 driver staging: media: remove MAX96712 driver arm64: defconfig: disable deprecated MAX96712 driver media: i2c: maxim-serdes: add MAX96717 driver media: i2c: remove MAX96717 driver media: i2c: add Maxim GMSL2/3 deserializer framework media: i2c: add Maxim GMSL2/3 serializer framework ...
3 daysMerge tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm updates from Dave Airlie: "Highlights: - core: a lot of atomic refactoring in progress, panic got split into a core/helpers model - amdgpu: enables HDMI 2.1 FRL and other good things finally, UAlink over Ethernet support - xe: has a bunch of CRI support, ras error for bad vram, memory offlining support. - msm: enables a bunch more GPUs. Otherwise it's a the usual mountain of stuff all over the place. Details: rust: - I/O tree shared with driver-core - DMA tree shared with driver-core - allow aux registration data closures to return covariant sub-fields - Implement Send and Sync for MapleTree - add pci resource flags and IORESOURCE_MEM_64 drm/rust: - add dma_fence abstraction - init DRM registrations and their data in place - drop unused flags argument to registration vgaarb: - rework API to pass a private ptr instead of pci device sound: - adapt to omapdrm changes gem: - add callback for handle count going to 0 gpusvm: - share one HMM fault and keep single mappings inline pagemap: - Prevent CPU stalls during unbounded pagemap teardown dma-fence: - fix docs vga_switcheroo: - disconnect from fbcon - update fbcon from within fbdev emulation atomic: - move DRM from state reset callbacks to atomic_create_state - remove drm_simple_encoder_init panic: - split into core and helpers buddy: - improve dirty tracking clients: - improve vmap handling - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko display: - export HDMI SCDC status data via debugfs - rework SCDC for better HDMI 2.0 support - dp/mst: improve DPCD compliance edid: - parse AMD VSDB - parse ALLM/VRR capabilities - support detecting panel size log: - add drm_warn_ratelimited sched: - cleanup interface - add missing locking - fix run-queue cleanup - fix locking sysfb: - remove obsolete quirk for Lenovo D330 - fix panel orientation for non-native display modes - drop drm_class_device_register colorop: - provide DRM_COLOR_OP_FIXED_MATRIX bridge: - analogix: Support eDP lane mapping - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84 - Select DRM_PANEL_BRIDGE for various drivers that require it - add chrontel ch7218a support panel: - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001 - samsung-s6d16d0: Use mipi_dsi_*_multi() functions - support Ilitek ILI7836A OLED plus DT bindings - support Novatek NT36532 plus DT bindings - convert several drivers to managed cleanup - fix Kconfig selections - edp: - Add support for BOE NV140FHM-T0A - Support CSOT MNE007QB1-1 - NV140WU2-M70 - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization - samsung: Share test-key helpers - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE DV215FHM-R01 plus DT bindings - Refactor struct drm_panel to contain struct drm_bridge plus fallout in various panel drivers - Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO B140HAN04.0, AUO 0x0db3, panels. amdgpu: - use AMD VSDB for freesync - implement YUV-to-RGB with fixed-matrix colorop - enable FRL for HDMI - HDMI 2.1 freesync support - HDMI 2.1 ALLM support - HDMI 2.1 VRR support - UALoE (UALink over Ethernet) support - add syncobj_points to userq signal ioctl - drop unused kunit tests - NBIO/GC/MMHUB/SMU updates/fixes - GPU spatial partitioning updates - display kunit fixes - userq fixes - RGB quantization fixes - DC RMCM refactor - DP MST fixes - USB4 fixes - add new trace events - Rework display instance handling - stack frame size fixes for various compilers/configs - VCN 4/5 reset fixes - freesync updates - cursor refactor - Fix direct scanout alpha on some DRM_FORMATs - Expand Mac reserved memory workaround - Make runtime pm more fine grained amdkfd: - updates and fixes - GC 10 CU occupancy support radeon: - eDP fix for DCE3.2 iMacs xe: - add drm_ras netlink error event support - add memory page offlining support - introduce error threshold to drm_ras - fix stale GTT mappings on unmap - reject page faults for non-page fault mode scratch VM - enable CRI package and VRAM temperatures - introduce cold reset recovery - handle CRI+ power interval encoding - VF migration for multi-queue - handle exec queue teardown after hot unplug - alerts and controller enabling modifications - use IBCv3 on PTL - VRAM health check - report GT TDR and VM rebind faults using SIGID - add multi_queue_active_lrca debugfs - shrinker: Runtime PM reference for non-system memory - guc: Add simple KLV decoder helpers - debugfs: Expose per-engine idle status - Keep walking on SVM eviction failure - Nuke PTs only after unlinking contested VMAs - limit sg segment size to PAGE_SIZE on Xen PV - keep VF LMEM bar size low if no VFs - CPU binds and ULLS on migration queue - New PTL PCI ID - Enable PXP for NVL-S - Do not dma_fence_put zero fences in err_out path - Refresh TTM LRU on SVM prefetch - export device UID in sysfs i915: - rename GEN6_PCODE_DATA to match spec - fix incorrect RCU teardown order - fix potential UAF in command parsing - avoid WARN splat during RPS boosting race - use simpler min functions - Fixes to make i915 work well with PREEMPT_RT i915/display: - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path - Switch DG2 MPLL to DPLL framework - DP-HDMI PCON DSC fixes - limit invalid joiner combinations - CDCLK related fixes and refactor around PCODE integration - Gate UHBR SST SDP splitting on sink caps - add HDMI TMDS audio bandwidth check - vswing/preemph override - enable AS SDP Skip frames - Handle negative configuration index on DP link caps for robustness - Preparation for enabling SDR plane color pipeline - An eDP quirk for HP Pavilion Plus - Introduce PME (Power Management Event) support on display hotplug - Handle VSC SDP revision 7 in unpack msm: - CI: - Dropped sc7180 trogdor lazor from the CI - Core: - Fixed msm_ioremap for resources without a name - Changed msm.separate_gpu_kms to default to auto selection - GPU: - Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding limits on CX/GX rails - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85 (Mahua) - Fix VBIF halt mask on a306, which was preventing runpm suspend - Enable THP support for GEM buffers - Add modparam to disable waiting on fences in shrinker - Drop use of drm_prime_sg_to_page_array() - a5xx: don't read the GPMU registers on GPUs without a GPMU - a2xx/a3xx/a5xx: hangcheck progress detection - a6xx: gmuwrapper runpm fix - Calculate reported GMEM size based on active slices - Split a6xx/a7xx/a8xx catalog - DP: - Picked up some preparation patches for the MST support - Fixed reported status of the link training - DPU: - Fixed CRTC bandwidth computation - Fixed DSC programming - Fixed encoder disablement path - DSI: - Fixed VM leak in error path - Indention fix - MDP5: - Added MSM8952 configuration - Dropped incorrect cursor pipe on MSM8976/56 - HDMI: - Small fixes nouveau: - improve runtime PM on R570 GSP firmware - various fixes throughout the driver - dispnv50: support 2.147 GHz pixel clock in GB20x nova: - add initial uapi concept - add initial PRAMIN access support - add GpuMm centralized memory manager - add GPU VM and BAR1 support - add GPU interrupts and GSP events support - GSP messaging fixes tyr: - use bitfield! - zero unsupported and newly added GPU info fields - limit doorbell array to 17 entries exynos: - FIMD fixes - Fix clock leak on resume error path - Fix Sparse warnings by adding missing __iomem annotation - VIDI cleanup - Replace kmalloc() and copy_from_user() with memdup_user() amdxdna: - fix BO handling - Support AIE2 rev 9 - Fix UAF access in scheduler fences - Update workqueue interface - expose busy time via fdinfo ast: - support 256-byte EDID hyperv_drm: - remove support for pre win10 hosts komeda: - fix GLB_CORE_ID usage omap: - report HDMI hotplug events to ASoC HDMI codec panthor: - provide gpu_cache_flush tracepoint - improve dma_fence signalling latency - improve locking - export scheduling information via debugfs - Validate user-space input against firmware limits qaic: - reject BOs that exceed maximum page count - add missing include statements verisilicon: - fix hardware cursor offsets vkms: - implement YUV-to-RGB with fixed-matrix colorop gma500: - avoid unsupported ARGB formats in primary plane hibmc: - handle vblank interrupts correctly ivpu: - add DRM_IVPU_CAP_CMDQ_SET_PRIORITY - support command-queue priority ioctl - Simplify NULL-pointer handling in cleanup code arcpgu: - replace simple-display pipeline with regular atomic helpers aspeed: - replace simple-display pipeline with regular atomic helpers gm12u320: - replace simple-display pipeline with regular atomic helpers imagination: - various improvement to firmware interaction - add job to pvr_job_submit_fw trace event mali-dp: - fix runtime PM leak mcde: - replace simple-display pipeline with regular atomic helpers p111: - replace simple-display pipeline with regular atomic helpers - drop unsupported alpha formats from primary plane rcar-du: - support Renesas R-Car V4H DSC - dsi: Support larger transfers with AXI memory - Support RZ/G3L SoC repaper: - replace simple-display pipeline with regular atomic helpers rockchip: - dsi: improve PHY timings ssd130x: - support Solomon SSD1351 OLED plus DT bindings - ssd133x: upgrade color format to RGB565 - ssd132x: Set correct hardware window when clearing screen tve200: - replace simple-display pipeline with regular atomic helpers xen: - replace simple-display pipeline with regular atomic helpers v3d: - improve job handling under perfmon vc4: - reliably reset V3D - drop brcm,vc4-v3d compatible virtio: - fix damage handling - Support ARGB8888 for virtio primary planes. host1x: - Support partitioning imx: - Replace simple-display with regular atomic helpers mxsfb: - Support bus formats plus DT bindings tegra: - improve syncobj handling on submit panfrost: - add Mali-G68 support - improve GPU reset handling rockchip: - add HDMI 2.0 support to dw-hdmi-qp - improve HPD handling" * tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel: (2324 commits) drm/adp: Switch to drm_atomic_helper_connector_create_state drm/malidp: Convert to atomic_create_state drm/vc4: Switch to drm_atomic_helper_connector_create_state drm/sysfb: Switch to drm_atomic_helper_connector_create_state drm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_state drm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_state drm/hyperv: Switch to drm_atomic_helper_connector_create_state drm/bridge: megachips: Switch to drm_atomic_helper_connector_create_state drm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_state drm/arm: komeda: Switch to drm_atomic_helper_connector_create_state drm/appletbdrm: Fix incorrect error message on encoder attach failure drm/sun4i: hdmi: Convert to drmm_connector_hdmi_init() drm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilities drm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilities drm/bridge: ite-it66121: Advertise HDMI 1.2 capabilities drm/bridge: ite-it6263: Advertise HDMI 1.3 capabilities drm/bridge: ite-it6263: Drop redundant .mode_valid hook drm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilities drm/bridge: adv7511: Advertise HDMI 1.2 capabilities drm/sched: Document entity->stopped is protected by entity->lock ...
3 daysMerge tag 'iommu-updates-v7.4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull IOMMU updates from Joerg Roedel: "Core: - Detect scatterlist length overflows and finalize deferred domain attachments before mapping MSI pages - Consolidate x86 MSI reserved-region handling and clean up internal DMA and SVA helpers AMD IOMMU: - Add IOMMU PerfOpt support, enabled by amdgpu for supported integrated GPUs in identity domains - Restrict forced identity mapping to GPUs that require it - Fix kdump device-table allocation and reuse, ATS configuration error handling, and an interrupt-remapping allocation leak - Clean up device probing and initialization - Add Vasant Hegde as an AMD IOMMU maintainer ARM SMMUv2: - Device-tree binding updates for Qualcomm Maili and Nord SoCs ARM SMMUv3: - Work around hardware integration issue on Google Tensor G5 SoCs where all DMA transactions appear as instruction fetches - Allow command queue size to be configured on the kernel command-line - Reduce queue sizes when running as a kdump kernel - Fix some pre-existing issues in the driver and kunit tests reported by Sashiko - Fix handling of Arm hardware errata relating to the contiguous hint when using SVA - Rework the TLB invalidation logic in preparation for enabling iommu-pt in future - Minor cleanups in preparation for improving support for kdump Apple DART: - Support device-tree DMA aperture specifications Broadcom: - Add BCM2712 IOMMU support for Raspberry Pi 5 display and multimedia devices, including the generic page-table format and shared TLB cache management Hyper-V: - Add a para-virtualized guest IOMMU driver with guest-managed stage-1 page tables and page-selective IOTLB invalidation Intel VT-d: - Enhanced IQE fault handling for batched multiple descriptors, - Optimization of page-table level calculation in compute_vasz_lg2_ss(), - Fixes for several pre-existing issues reported by Sashiko, - General cleanup and refinement RISC-V: - Report cache-coherency capability for coherent devices, enabling VFIO/iommufd use Samsung Exynos: - Support SysMMUs without BLOCK mode, fixing their enable sequence and TLB invalidation - Improve v7 fault diagnostics with transaction information" * tag 'iommu-updates-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (69 commits) MAINTAINERS: Make Vasant Hegde AMD IOMMU maintainer iommu/hyperv: Make hv_iommu_device static iommu/hyperv: Add missing PCI dependency for the guest IOMMU driver iommu/amd: Don't allocate kdump device table from DMA32 iommu/amd: Program device table when kdump reuse fails iommu/dma: Clean up redundant MSI cookie check iommu/dma: Catch scatterlist length overflows iommu/hyperv: Add page-selective IOTLB flush support iommu/hyperv: Add para-virtualized IOMMU support for Hyper-V guest iommu/x86: Add architectural MSI reserved region helper Drivers: hv: Add logical device ID registry for vPCI devices hyperv: Introduce new hypercall interfaces used by Hyper-V guest IOMMU iommu: Make iommu-dma helpers private iommu/arm-smmu-v3: Don't rb_erase() a never-inserted stream node iommu/arm-smmu-v3: Add Q_POS() macro iommu/arm-smmu-v3: Add arm_smmu_attach_release() iommu/arm-smmu-v3: Disable the impl before disabling the SMMU on shutdown iommu/arm-smmu-v3: Populate the tlbi at the top of the call chain iommu/arm-smmu-v3: Precompute the invalidation commands iommu/arm-smmu-v3: Keep track in arm_smmu_invs if range invalidation is used ...
3 daysMerge tag 'vfio-v7.4-rc1' of https://github.com/awilliam/linux-vfioLinus Torvalds
Pull VFIO updates from Alex Williamson: - Fix missing selftest <libgen.h> include for basename() to support non-glibc builds (Hisam Mehboob) - Add vfio selftest documentation covering the libvfio helper library and guidance for developers to aid in adding and understanding the framework (David Matlack) - Fix vfio cdev open path to prevent a second open from clobbering the vf_token or clearing the KVM reference. Add a selftest to avoid future recurrences (Alex Williamson) - Extend vfio selftest mix_and_match timeouts, in particular to account for systems where generated faults can induce heavy SMM load, delaying internal timeouts. Also extend timeout for execution via runner to account for various tests exceeding default 45s timeout (Alex Williamson) - Add tracking for non-reserved mappings into a vfio_dma object in order to optimize the tear-down paths where per-page tests can be entirely skipped. This resolves a soft lockup for large memory GPUs (Samuel Crossley) - Add vfio selftest driver for mlx5, providing another target for exercising DMA and interrupts against a physical device (Jason Gunthorpe) - Hardening against read-only region promotion, preserving vm_pgoff for unmap_mapping_range(), and reject non-shared MMIO mmaps as necessary through vfio-platform, vfio-fsl-mc, and vfio-cdx. These prevent future issues, though none are currently reachable (Abdifatah Suruur) - Fix 8-byte ioeventfd support, removing a static error test that was erroneously left in place when generalizing 8-byte io accesses (Li RongQing) - Fix missed RCU drain on module exit (Jiale Yao) - Fix off-by-one boundary check in migration support within the mlx5 vfio-pci variant driver (Seongjun Hong) - Remove drvdata usage convention across vfio-pci-core, allowing variant drivers to freely create their own conventions and enabling a future Rust-based variant driver. A DRM topic branch is also merged in support of this effort, modifying the vga arbiter API to more cleanly remove the drvdata dependency (Simon Song) - Fix hisi_acc vfio-pci variant driver to avoid NULL pointer accesses when bound to unsupported devices and also disabling migration support when running on 64K host page size due to BAR mapping constraints (Longfang Liu) - Add device IDs for Crescent Island and Nova Lake devices to the Xe vfio-pci variant driver (Satyanarayana K V P) - Fix fallback mode in nvgrace-gpu variant driver to use symmetric open and close handlers to avoid reported use-after-free issue. Remove the resulting unnecessary test in the now single-purpose open function (Andrea Parri) * tag 'vfio-v7.4-rc1' of https://github.com/awilliam/linux-vfio: (35 commits) vfio/nvgrace-gpu: Drop the usemem length check in open_device vfio/nvgrace-gpu: Use a core-only open_device in fallback mode vfio/xe: Add CRI and NVL device IDs hisi_acc_vfio_pci: reject live migration on 64KB page with QM_HW_V3 hardware hisi_acc_vfio_pci: fix NULL dereference in reset_prepare on PF passthrough vfio/pci: Remove the core dependency on driver data vfio/mlx5: Fix boundary check in set_report_output() vfio/pci: Drain eventfd RCU callbacks on module exit PCI/VGA: pass a data pointer to be used in the decode callback (v2) vfio/pci: Restore 8-byte ioeventfd support vfio/cdx: reject non-shared MMIO mmaps vfio/cdx: keep logical vm_pgoff in MMIO region mmap vfio/fsl-mc: keep logical vm_pgoff in MMIO region mmap vfio/platform: keep logical vm_pgoff in MMIO region mmap vfio/cdx: prevent read-only region mappings from becoming writable vfio/fsl-mc: prevent read-only region mappings from becoming writable vfio/platform: prevent read-only region mappings from becoming writable vfio: selftests: Verify a failed second open preserves the vf_token vfio: selftests: mlx5 driver - add send_msi support vfio: selftests: Add mlx5 driver - data path and memcpy ops ...
4 daysMerge tag 'modules-7.4-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Petr Pavlu: - Ignore local labels and mapping symbols during module load These symbols were already ignored during kallsyms address-to-symbol lookups. Filter them out earlier during module loading to reduce lookup overhead and prevent them from appearing in /proc/kallsyms. - Fix potentially incorrect access of SetOnce<T> when setting Rust module parameters. - Fix a potential read of an uninitialized count when printing taint information for unloaded modules. - Allocate the kmod argument array using kmalloc_array() in preparation for conversion to type-aware allocators. - Clean up includes in linux/kmod.h Add explicit includes of linux/umh.h to files that use usermode helpers. Then clean up the #include list in linux/kmod.h, notably removing the compatibility linux/umh.h include. - Remove the error-injection.h include from linux/module.h Add explicit includes of linux/error-injection.h to files that use the ALLOW_ERROR_INJECTION() macro and currently rely on it being provided indirectly via linux/module.h. Then remove the unnecessary linux/error-injection.h include from linux/module.h. - Replace __MODULE_STRING() with __stringify() in various drivers in preparation for removing the former macro. * tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: drivers: Replace __MODULE_STRING() with __stringify() module: Fix uninitialized count read of unloaded taint tracking record rust: module_param: Fix potentially incorrect access of `SetOnce<T>` module: Remove the error-injection.h include from linux/module.h drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION() drm/i915: Include error-injection.h for ALLOW_ERROR_INJECTION() syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION() net: Include error-injection.h for ALLOW_ERROR_INJECTION() block: Include error-injection.h for ALLOW_ERROR_INJECTION() module: Bring includes in linux/kmod.h up to date time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ... umh, treewide: Explicitly include linux/umh.h where needed modules/kmod: Allocate argv with kmalloc_array() module/kallsyms: Ignore local labels and mapping symbols during module load module/kallsyms: Refactor current symbol filtering into is_core_symbol() module/kallsyms: Rename is_mapping_symbol() to is_ignored_kernel_symbol()
5 daysMerge tag 'driver-core-7.4-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "Core: - Add TAINT_FORCED_BIND to taint the kernel and driver module before manual sysfs bind/unbind operations; make add_taint_module() available to driver core and update taint decoding tools and documentation - Constify device_show/store_*() attribute parameters and adapt x86 MCE and perf users to prepare for const dev_ext_attribute instances - Fix UAF in NUMA access node registration failure handling by dropping the device reference with put_device() instead of directly freeing the node debugfs: - Make debugfs_create_str() read-only to eliminate double-free races between concurrent writers; reject writable modes; convert interconnect and SoundWire users to local file operations with mutex-protected strings kobject: - Fix out-of-bounds access in kobject_action_type() when parsing action strings containing embedded NUL bytes - Fix the kobject_set_name() reference in kset_register() kernel-doc Rust: - DMA: - Tie Coherent, CoherentBox and CoherentHandle to the device's bound lifetime to prevent retaining DMA allocations beyond driver unbind; propagate the lifetime through nova-core and the DMA sample driver - I/O: - Require explicit base types for registers and replace relative registers with typed subregion projections; reimplement register!() as a proc macro, support registers using existing types without inline bitfields, and convert nova-core, Tyr and the PCI sample; add AsRepr/AsReprMut and transmute helpers with deferred size checks for representation conversions - Wrap ResourceSize in a transparent newtype with explicit conversions, including checked conversion to usize - PCI: - Add typed PCIe extended capability lookup and SR-IOV accessors for the First VF Offset and decoded VF BAR addresses and widths, keeping raw SR-IOV registers private to preserve PCI core ownership of their state - scatterlist: - Honor the device's maximum segment size as well as the DMA mapping limit when constructing SG tables - Return u32 from SGEntry::dma_len() to match the C segment length type - misc: - Validate auxiliary DeviceId name length explicitly to improve compile-time diagnostics for oversized device ID table entries - Drop unnecessary 'static bounds from debugfs ScopedDir file creation methods to support data containing non-'static references, including DMA buffers Misc: - Add Johan Hovold as driver core maintainer - Simplify platform_device_alloc() by returning early on allocation failure - Fix typos in driver core and kernfs comments" * tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits) rust: pci: add extended capability and SR-IOV support kobject: Fix the kobj_set_name reference in kset_register() kernel-doc rust: io: convert ResourceSize into a transparent newtype rust: scatterlist: return u32 from SGEntry::dma_len() MAINTAINERS: add myself as driver core maintainer debugfs: make debugfs_create_str() read-only soundwire: debugfs: replace writable string helper interconnect: debugfs: replace writable string helper docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted driver core: platform: Simplify platform_device_alloc() kobject: fix out-of-bounds access in kobject_action_type() rust: scatterlist: honor the device's maximum segment size driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers module: fix up documentation for add_taint() and add_taint_module() module: pull out add_taint_module() to be public driver core: Constify the signature of device_show/store_*() drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute rust: auxiliary: validate DeviceId name length driver core: fix typos in comments ...
6 daysMerge __{get,put}_user() removal branchLinus Torvalds
This is long over-due: the __get_user() and __put_user() functions are entirely historical, and are never the rigth thing to use any more. And when mis-used (read: every case) they are not only slower than the right thing, but also insecure because they don't check the user address range. Most of the usage sites have been converted long ago, but various left-overs remained. So this started out as a single patch that I wrote as a "show people how to convert __{get,put}_user() to modern code". In particular, Thomas last year implemented the very nice new scoped user access region helpers (see commit e497310b4ffb: "uaccess: Provide scoped user access regions") that makes the modern interfaces particularly easy to use and really removes any excuse for the old horrors. That small example patch then grew to this, partly using Claude as a glorified coccinelle script to apply the pattern to other places. There were a few different reasons for using __put_user() and __get_user() rather than the alternatives, but the original historical one was performance: when doing multiple accesses off the same base pointer, doing a single range check followed by multiple non-checked accesses used to create smaller and faster code. The keyword here is "used to". It hasn't been true for years, because the range check isn't actually the real cost these days. The real cost of user accesses on modern hardware is turning the user accesses on and off in the first place (on x86, using the STAC/CLAC instructions). Those sequences get turned into 'scoped_user_read_access() { }' blocks, see for example that first patch in the series: "signal: use scoped user access for old-style sigaction". Another, historical reason for using __get_user() and friends is that you actually want to do a kernel pointer access, but the pointer might not be entirely reliable (typically during fault handling), so you want to have exception handling for the kernel access. The modern way to do that kind of non-faulting kernel access is using "get_kernel_nofault()", but some code predates that helper existing at all, and used __get_user() as a way to just get a memory access with exception handling. For that pattern, see for example "alpha: use get_kernel_nofault() in dik_show_code()" A third bad reason for using __get_user() and friends was that the proper get_user() had a "might_fault()" in it, and code that ran in atomic regions but hadn't disabled page faults would result in a warning. That kind of code needs to explicitly disable page faults, because "atomic region" is not well defined at run-time and can be invisible (eg a preempt-off region in a non-preemptible kernel). See "vdpa_sim: disable page faults around vringh_need_notify_iotlb()" for an example of that pattern, where the local_bh_disable() now also grows a pagefault_disable(), which makes the normal get_user() no longer warn about the user access in non-process context, because it can see that the potential page fault will not cause problems. And finally, the really nasty reason to use __get_user() and friends: pointers that can be either kernel pointers or user pointers. We've gotten rid of almost all such cases, but a couple remained. See for example "x86/sev: Use explicit user-or-kernel accessors for #VC memory operands". NOTE! This series removes all __get/put_user() calls from generic code but only does the final removal of the whole interface on x86. Other architectures have not been entirely converted, for a variety of reasons: - arm64 makes __{get,put}_user() be exactly the same as {get,put}_user() so it's harmless and didn't have the dangers of the legacy use cases. - any architecture that uses <asm-generic/uaccess.h> will still use __{get,put}_user as the underlying helper function name - several architectures had some legacy uses that weren't entirely trivial and I didn't want to extend this patch series to things that I don't know and that don't really matter. but I did do a couple of the obvious "follows the exact same pattern" just because it could be done mindlessly and automatically. Let's see if I broke anything, but we should have done this years ago. * uaccess-cleanups: (48 commits) drm/i915/gem: ignore errors on presumed_offset write-back powerpc/align: use get_user_instr() for a user-mode instruction powerpc/signal64: use scoped user access in setup_trampoline() powerpc/signal64: use get_user() for the single context reads powerpc/signal32: use get_user() for the single context reads KVM: PPC: Book3S HV: use get_user()/put_user() for the HPT fd powerpc/powernv: use get_user()/put_user() in the LPC debugfs files s390: use get_user()/put_user() instead of the unchecked variants ARM: OABI: use scoped user access in epoll_put_uevent() ARM: signal: stop using __put_user() for the signal frame ARM: signal: check the FDPIC function descriptor address alpha: split the prefetch check in do_page_fault() by mode openrisc: use get_kernel_nofault() in show_registers() alpha: use get_kernel_nofault() in dik_show_code() nios2: use scoped user access for the signal frame nios2: check the signal frame address before writing to it hexagon: use scoped user access for the signal frame alpha: use scoped user access when setting up signal frames alpha: use scoped user access in the sigreturn path alpha: use scoped user access in osf_sigaction() ...
6 daysdrm/i915/gem: ignore errors on presumed_offset write-backLinus Torvalds
It appears that the crazy "don't check for errors" code in the i915 relocation code was intentional, but not visible in the code as such. See commit 97a37c919f62 ("drm/i915/gem: Ignore readonly failures when updating relocs"). Quoting that commit: "Be damned if you do, and damned if you don't." So disable the error check again, but leave it around visibly for posterity as documentation for why it's not there. Fixes: 03c19e449ac6 ("drm/i915/gem: Don't fault on presumed_offset write-back") Reported-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
6 daysMerge tag 'configfs-7.4-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux Pull configfs updates from Breno Leitao: - Attribute structures can now be const (Thomas Weißschuh) - The first selftests for the configfs userspace interface, plus a sample subsystem that accepts symlinks to test against. They include a race of symlink(2) against rmdir of the target, which exercises the use-after-free fixed in v7.3-rc3. - Rust bindings, merged from Andreas Hindborg's signed tag: fix the data offset calculation in subsystem callbacks (marked for stable), add the missing Send and Sync bounds, and correct a safety comment. * tag 'configfs-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/leitao/linux: samples: configfs: constify the configfs_attribute structures configfs: Allow the registration of const struct configfs_attribute configfs: Constify configfs_bin_attribute configfs: Treat attribute structures as const internally configfs: Constify is_visible/is_visible_bin in configfs_group_operations rust: configfs: remove mutability from some field initializers selftests/configfs: race symlink against rmdir of the target selftests/configfs: cover symlink and unlink samples/configfs: add a subsystem that accepts symlinks selftests/configfs: add tests for the userspace interface rust: configfs: fix data offset calculation for subsystem callbacks rust: configfs: require thread-safe callback data rust: configfs: fix release safety documentation
6 daysMerge tag 'drm-misc-next-2026-10-16' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for v7.5: UAPI Changes: - Add Apple Interchange fourcc. - Expose amdxdna busy time via DRM fdinfo. Cross-subsystem Changes: - Improve DT bindings for display/ste,mcde - Add kunit test for dma_fence_dedup_array() to dma-buf/test. Core Changes: - Documentation updates to drm/scheduler, gpu/buddy. - Fail kmapping a bo without pages. Driver Changes: - Bugfixes and improvements to panel/Raystar RFF500F-AWH-DNN, accel/ivpu, vc4, accel/amdxdna, panthor, nouveau, panfrost, panthor, accel/qaic, accel/rocket, bridge/lontium-lt8713sx, appletbdrm. - Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO B140HAN04.0, AUO 0x0db3, panels. - Add support for Mali-G68 to panfrost. - Add Chrontel CH7218A to bridge/simple. - Support ARGB8888 for virtio primary planes. - Improve panfrost gpu reset handling and initialization. - Add HDMI 2.0 support to rockchip/dw-hdmi-qp and improve HPD handling. - Advertise HDMI 1.2 capabilities in sun4i, bridge/adv7511, it66121 & inno-hdmi. - Advertise HDMI 1.3 capabilities in bridge/ite-6263. - Advertise HDMI 1.4 capabilities in bridge/lt9611 & rockchip/rk3066_hdmi - Switch many drivers to drm_atomic_helper_create_state in preparation for readout. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/75e7de61-048c-4fdd-9ad2-6b47b29a4863@linux.intel.com
7 daysdrm/i915/gem: Use get_user()/put_user() where no locks are heldLinus Torvalds
execbuffer prefaults the relocation array and reads timeline fence values one element at a time with __get_user(), after checking each array with access_ok() up front. Each of those accesses enables and disables user access on its own, so the up-front check saves nothing. Both run with no object locks held: the prefault between dropping and retaking the ww locks, the fence parsing before the ww context exists. Use get_user(). The access_ok() checks stay, since they also decide how a bad array fails. The gem mman selftests use the unchecked variants on addresses they got from their own mmaps, with no check at all. Convert those too. This is part of getting rid of __get_user() and __put_user() entirely. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
7 daysdrm/i915/gem: Don't fault on presumed_offset write-backLinus Torvalds
The execbuffer relocation fast path writes each updated presumed_offset back to the user's relocation array with __put_user(), ignoring any failure. It does that while holding the objects' dma_resv locks, and with page faults enabled unless the relocation cache happens to have an atomic mapping active. So if that write faults, for example on a copy-on-write page after a fork(), the fault handler takes mmap_lock under dma_resv. That is the opposite of the order the i915 fault handler uses, which takes the object lock under mmap_lock. The comment above it claimed this could not happen, because "we did previously check if the relocations were writable (access_ok)". access_ok() is purely a range check. The comment dates from when this was access_ok(VERIFY_WRITE), and that only ever made a difference on the original i386, whose write-protect bit did not stop supervisor writes. So nothing has made sure the array was writable for decades. Do the write with page faults disabled, and if it fails, fall back to the slow path exactly as we already do when reading the relocations fails part-way through. We cannot just ignore the failure: the object has already been relocated, and a stale presumed_offset could later match again and skip a relocation that is needed. The slow path prefaults and retries. If the write still fails, it copies the relocations and marks every presumed_offset invalid with faults allowed and no locks held, which breaks copy-on-write as needed. One user-visible change: a relocation array in genuinely read-only memory used to get through the fast path, silently losing the presumed_offset updates. It now gets -EFAULT from the slow path, as it already did whenever anything else sent execbuffer there. The uapi has the kernel updating presumed_offset, so the array is expected to be writable. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
7 daysMerge branches 'apple/dart', 'arm/smmu/updates', 'arm/smmu/bindings', ↵Joerg Roedel
'hyper-v', 'samsung/exynos', 'riscv', 'broadcom', 'intel/vt-d', 'amd/amd-vi' and 'core' into next
7 daysMerge tag 'vfs-7.4-rc1.file' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull file table updates from Christian Brauner: "This annotates struct fdtable's fd array with __counted_by_ptr so KASAN and the fortified functions can bounds check it against max_fds and adds a KUnit suite for fdtable. A follow-up uses __struct_size() in the test since sparse doesn't know __builtin_dynamic_object_size(). FD_PREPARE() is simplified. It was built as an ACQUIRE-style guard on infrastructure that was never needed. The ACQUIRE machinery and CLASS_INIT() go away, the variable is declared with __cleanup() directly, struct fd_prepare loses its err field since the fd either holds the descriptor or the error, and callers get a const pointer to the guard behind a UNIQUE_ID() name so they can't shadow it. Code generation is identical" * tag 'vfs-7.4-rc1.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: file: make struct fd_prepare const and kill its err field cleanup: remove CLASS_INIT() file: declare the FD_PREPARE() variable with __cleanup() directly file: simplify FD_PREPARE() vfs: use __struct_size() in the fdtable KUnit test vfs: Add KUnit tests for fdtable vfs: Annotate struct fdtable's fd field with __counted_by_ptr
11 daysconfigfs: Constify is_visible/is_visible_bin in configfs_group_operationsThomas Weißschuh
These callbacks are never meant to modify their configfs_attribute structure. Enforce this in the type system. As there are only two implementers of these callbacks, adapt them right away, avoiding a phased transition. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Reviewed-by: Breno Leitao <leitao@debian.org> Acked-by: Andreas Hindborg <a.hindborg@kernel.org> Link: https://patch.msgid.link/20260716-configfs-const-base-v1-2-c545a4053cb5@weissschuh.net Signed-off-by: Breno Leitao <leitao@debian.org>
11 daysdrm/adp: Switch to drm_atomic_helper_connector_create_stateMaxime Ripard
The adp connector implementation uses the deprecated drm_atomic_helper_connector_reset() as its reset hook. Switch to drm_atomic_helper_connector_create_state() instead. Acked-by: Aditya Garg <aditya.garg@linux.dev> Link: https://lore.kernel.org/r/20261014-drm-no-more-connector-reset-v1-2-586c9c026823@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
11 daysdrm/malidp: Convert to atomic_create_stateMaxime Ripard
The malidp writeback connector reset implementation creates a custom state subclass, but only initializes a pristine state without resetting any hardware. This is equivalent to what atomic_create_state expects. Convert to it. Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://lore.kernel.org/r/20261014-drm-no-more-connector-reset-v1-67-586c9c026823@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
11 daysdrm/vc4: Switch to drm_atomic_helper_connector_create_stateMaxime Ripard
The vc4 connector implementation uses the deprecated drm_atomic_helper_connector_reset() as its reset hook. Switch to drm_atomic_helper_connector_create_state() instead. Reviewed-by: Maíra Canal <mcanal@igalia.com> Link: https://lore.kernel.org/r/20261014-drm-no-more-connector-reset-v1-51-586c9c026823@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
11 daysdrm/sysfb: Switch to drm_atomic_helper_connector_create_stateMaxime Ripard
The sysfb connector implementation uses the deprecated drm_atomic_helper_connector_reset() as its reset hook. Switch to drm_atomic_helper_connector_create_state() instead. Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://lore.kernel.org/r/20261014-drm-no-more-connector-reset-v1-39-586c9c026823@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
11 daysdrm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_stateMaxime Ripard
The solomon: ssd130x connector implementation uses the deprecated drm_atomic_helper_connector_reset() as its reset hook. Switch to drm_atomic_helper_connector_create_state() instead. Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://lore.kernel.org/r/20261014-drm-no-more-connector-reset-v1-35-586c9c026823@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
11 daysdrm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_stateMaxime Ripard
The imx: ipuv3 connector implementation uses the deprecated drm_atomic_helper_connector_reset() as its reset hook. Switch to drm_atomic_helper_connector_create_state() instead. Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://lore.kernel.org/r/20261014-drm-no-more-connector-reset-v1-25-586c9c026823@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
11 daysdrm/hyperv: Switch to drm_atomic_helper_connector_create_stateMaxime Ripard
The hyperv connector implementation uses the deprecated drm_atomic_helper_connector_reset() as its reset hook. Switch to drm_atomic_helper_connector_create_state() instead. Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com> Tested-by: Saurabh Sengar <ssengar@linux.microsoft.com> Link: https://lore.kernel.org/r/20261014-drm-no-more-connector-reset-v1-24-586c9c026823@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
11 daysdrm/bridge: megachips: Switch to drm_atomic_helper_connector_create_stateMaxime Ripard
The bridge: megachips connector implementation uses the deprecated drm_atomic_helper_connector_reset() as its reset hook. Switch to drm_atomic_helper_connector_create_state() instead. Reviewed-by: Ian Ray <ian.ray@gehealthcare.com> Link: https://lore.kernel.org/r/20261014-drm-no-more-connector-reset-v1-12-586c9c026823@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
11 daysdrm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_stateMaxime Ripard
The bridge: lontium-lt8912b connector implementation uses the deprecated drm_atomic_helper_connector_reset() as its reset hook. Switch to drm_atomic_helper_connector_create_state() instead. Acked-by: Francesco Dolcini <francesco.dolcini@toradex.com> Link: https://lore.kernel.org/r/20261014-drm-no-more-connector-reset-v1-11-586c9c026823@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
11 daysdrm/arm: komeda: Switch to drm_atomic_helper_connector_create_stateMaxime Ripard
The arm: komeda connector implementation uses the deprecated drm_atomic_helper_connector_reset() as its reset hook. Switch to drm_atomic_helper_connector_create_state() instead. Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://lore.kernel.org/r/20261014-drm-no-more-connector-reset-v1-5-586c9c026823@kernel.org Signed-off-by: Maxime Ripard <mripard@kernel.org>
11 daysdrm/appletbdrm: Fix incorrect error message on encoder attach failureAdam Azuddin
drm_connector_attach_encoder() replaced an earlier call to drm_simple_display_pipe_init() during review, but the error message logged on failure was not updated to match and still refers to the old call. Fixes: 0670c2f56e45 ("drm/tiny: add driver for Apple Touch Bars in x86 Macs") Signed-off-by: Adam Azuddin <azuddinadam@gmail.com> Signed-off-by: Lukas Wunner <lukas@wunner.de> Link: https://patch.msgid.link/20260926-fix-err-msg-appletbdrm-v1-1-bb578a7dbdda@gmail.com
11 daysdrm/sun4i: hdmi: Convert to drmm_connector_hdmi_init()Cristian Ciocaltea
Switch driver over to the new drmm_connector_hdmi_init() signature and advertise HDMI 1.2 support. The vendor, product, supported_formats and max_bpc values previously passed as arguments are now provided through struct drm_connector_hdmi_funcs, together with the new supported_hdmi_ver field. The HDMI connector helpers infer the 165 MHz TMDS character rate ceiling from supported_hdmi_ver and reject modes exceeding it before invoking the driver's .tmds_char_rate_valid() hook. This makes the explicit mode clock check in sun4i_hdmi_connector_clock_valid() redundant, so drop it. No functional change intended. Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Tested-by: Igor Paunovic <royalnet026@gmail.com> # RK3588 Orange Pi 5 Plus, dual HDMI Tested-by: Robin Räber <robin.raebi@gmail.com> Link: https://patch.msgid.link/20261001-bridge-advert-hdmi-caps-v1-8-f8806570e243@collabora.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
11 daysdrm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilitiesCristian Ciocaltea
Bridges using DRM_BRIDGE_OP_HDMI are now expected to also provide a supported HDMI version. This is not yet enforced, but will become mandatory once the migration to the new caps-based HDMI connector initialization API is completed. The RK3066 HDMI TX supports HDMI 1.4a, as described in commit f84d3d37b7fb ("drm: rockchip: introduce rk3066 hdmi"). However, the driver does not currently enforce a maximum TMDS character rate, it only filters non-CEA modes and excludes VIC 1 (640x480) via the .mode_valid callback. Advertise HDMI 1.4 support for now so that modes exceeding the 340 MHz TMDS limit are rejected by the core. Reviewed-by: Heiko Stuebner <heiko@sntech.de> Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Tested-by: Igor Paunovic <royalnet026@gmail.com> # RK3588 Orange Pi 5 Plus, dual HDMI Tested-by: Robin Räber <robin.raebi@gmail.com> Link: https://patch.msgid.link/20261001-bridge-advert-hdmi-caps-v1-7-f8806570e243@collabora.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
11 daysdrm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilitiesCristian Ciocaltea
Bridges using DRM_BRIDGE_OP_HDMI are expected to provide the supported HDMI version. This is not enforced yet, but will become mandatory once the migration to the caps-based HDMI connector initialization API is complete. As LT9611 supposedly cannot drive a TMDS character rate exceeding 297 MHz, advertise HDMI 1.4 as the supported version. HDMI 1.4 allows up to 340 MHz, so set the bridge's max_tmds_char_rate to ensure the connector limit derived from supported_hdmi_ver remains within the hardware capabilities. drm_bridge_connector_atomic_check() calls drm_atomic_helper_connector_hdmi_check(), which rejects modes whose computed TMDS character rate exceeds the connector's max_tmds_char_rate before invoking the driver's .tmds_char_rate_valid hook. Since max_tmds_char_rate now carries the existing effective limit, lt9611_hdmi_tmds_char_rate_valid() is redundant. Drop it. Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Tested-by: Igor Paunovic <royalnet026@gmail.com> # RK3588 Orange Pi 5 Plus, dual HDMI Tested-by: Robin Räber <robin.raebi@gmail.com> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS, Rock 5B Link: https://patch.msgid.link/20261001-bridge-advert-hdmi-caps-v1-6-f8806570e243@collabora.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
11 daysdrm/bridge: ite-it66121: Advertise HDMI 1.2 capabilitiesCristian Ciocaltea
Bridges using DRM_BRIDGE_OP_HDMI are now expected to also provide a supported HDMI version. This is not yet enforced, but will become mandatory once the migration to the new caps-based HDMI connector initialization API is completed. Since none of the chip variants handled by the driver can drive a TMDS character rate exceeding 148.5 MHz, advertise HDMI 1.2 as the supported version. HDMI 1.2 allows up to 165 MHz, so set the bridge's max_tmds_char_rate to ensure the connector limit derived from supported_hdmi_ver remains within the hardware capabilities. drm_bridge_connector_atomic_check() runs drm_atomic_helper_connector_hdmi_check(), which rejects modes whose computed TMDS character rate exceeds the connector limit before invoking the driver's .tmds_char_rate_valid() hook, making the max_rate check in it66121_bridge_hdmi_tmds_char_rate_valid() redundant. Drop it. Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Igor Paunovic <royalnet026@gmail.com> # RK3588 Orange Pi 5 Plus, dual HDMI Tested-by: Robin Räber <robin.raebi@gmail.com> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS, Rock 5B Link: https://patch.msgid.link/20261001-bridge-advert-hdmi-caps-v1-5-f8806570e243@collabora.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
11 daysdrm/bridge: ite-it6263: Advertise HDMI 1.3 capabilitiesCristian Ciocaltea
Bridges using DRM_BRIDGE_OP_HDMI are expected to provide the supported HDMI version. This is not enforced yet, but will become mandatory once the migration to the caps-based HDMI connector initialization API is complete. Advertise HDMI 1.3 support for IT6263, covering the 225 MHz TMDS character rate currently documented by the driver, which is within the HDMI 1.3 limit of 340 MHz. Additionally, keep the stricter 150 MHz effective mode limit by setting max_tmds_char_rate from MAX_PIXEL_CLOCK_KHZ. The existing .hdmi_tmds_char_rate_valid() hook checks both the pixel clock and TMDS character rate. Since the bridge only supports 8 bpc RGB444, these are equivalent for supported modes, making the 225 MHz TMDS rate check unreachable once the 150 MHz pixel-clock limit is applied. drm_bridge_connector_atomic_check() invokes drm_atomic_helper_connector_hdmi_check(), which rejects modes whose computed TMDS character rate exceeds the connector's max_tmds_char_rate before invoking the driver's .tmds_char_rate_valid hook. Since max_tmds_char_rate now carries the existing effective limit, it6263_hdmi_tmds_char_rate_valid() is redundant. Drop it. Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Tested-by: Igor Paunovic <royalnet026@gmail.com> # RK3588 Orange Pi 5 Plus, dual HDMI Tested-by: Robin Räber <robin.raebi@gmail.com> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS, Rock 5B Link: https://patch.msgid.link/20261001-bridge-advert-hdmi-caps-v1-4-f8806570e243@collabora.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
11 daysdrm/bridge: ite-it6263: Drop redundant .mode_valid hookCristian Ciocaltea
Bridges using DRM_BRIDGE_OP_HDMI expect connectors to be created through drm_bridge_connector_init(), thereby relying on the bridge connector's .mode_valid hook to invoke drm_hdmi_connector_mode_valid(). The generic helper computes the mode's TMDS character rate and forwards it to the bridge's .hdmi_tmds_char_rate_valid callback through the connector HDMI funcs. This covers exactly what it6263_bridge_mode_valid() does for 8 bpc RGB444, but due to being output-format aware, it also handles the validation more thoroughly. Both the connector and bridge .mode_valid hooks are invoked during mode validation through drm_mode_validate_pipeline(), so the custom bridge hook is redundant. Drop it. While at it, remove the now-unused drm_hdmi_helper.h include. Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Tested-by: Igor Paunovic <royalnet026@gmail.com> # RK3588 Orange Pi 5 Plus, dual HDMI Tested-by: Robin Räber <robin.raebi@gmail.com> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS, Rock 5B Link: https://patch.msgid.link/20261001-bridge-advert-hdmi-caps-v1-3-f8806570e243@collabora.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
11 daysdrm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilitiesCristian Ciocaltea
Bridges using DRM_BRIDGE_OP_HDMI are now expected to also provide a supported HDMI version. This is not yet enforced, but will become mandatory once the migration to the new caps-based HDMI connector initialization API is completed. Since inno_hdmi_phy_config.pixelclock does not exceed 165 MHz for any of the chip variants handled by the driver, advertise HDMI 1.2 as the supported version. Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Tested-by: Igor Paunovic <royalnet026@gmail.com> # RK3588 Orange Pi 5 Plus, dual HDMI Tested-by: Robin Räber <robin.raebi@gmail.com> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS, Rock 5B Link: https://patch.msgid.link/20261001-bridge-advert-hdmi-caps-v1-2-f8806570e243@collabora.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
11 daysdrm/bridge: adv7511: Advertise HDMI 1.2 capabilitiesCristian Ciocaltea
Bridges using DRM_BRIDGE_OP_HDMI are now expected to also provide a supported HDMI version. This is not yet enforced, but will become mandatory once the migration to the new caps-based HDMI connector initialization API is completed. Since max_mode_clock_khz does not exceed 165 MHz for any of the chip variants handled by the driver, advertise HDMI 1.2 as the supported version and set the bridge's max_tmds_char_rate so the connector limit inferred from supported_hdmi_ver is overridden by the chip-specific hardware constraints. drm_bridge_connector_atomic_check() runs drm_atomic_helper_connector_hdmi_check(), which rejects modes whose computed TMDS character rate exceeds the connector limit before invoking the driver's .tmds_char_rate_valid() hook, making adv7511_bridge_hdmi_tmds_char_rate_valid() redundant. Drop it. Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Tested-by: Igor Paunovic <royalnet026@gmail.com> # RK3588 Orange Pi 5 Plus, dual HDMI Tested-by: Robin Räber <robin.raebi@gmail.com> Tested-by: Diederik de Haas <diederik@cknow-tech.com> # NanoPC-T6 LTS, Rock 5B Link: https://patch.msgid.link/20261001-bridge-advert-hdmi-caps-v1-1-f8806570e243@collabora.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
11 daysMerge tag 'amd-drm-fixes-7.3-2026-10-15' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes amd-drm-fixes-7.3-2026-10-15: amdgpu: - UVD fix - TTM sched entity fixes - SMU 14 fix - Userptr leak fixes - Runpm ref count fix - CRIU fix - UserQ fixes - USB4 fix - SDMA 3 fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20261015221002.1728931-1-alexander.deucher@amd.com
11 daysMerge tag 'drm-xe-fixes-2026-10-15' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes An OA uAPI fix by zeroing OA buffer at allocation, and other 3 small fixes around eviction and shrinker. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/atDNMV-Aohu6s0gE@intel.com
11 daysdrm/appletbdrm: Add suspend and resume supportVasilij Markin
The driver has no USB power management callbacks, so the USB core unbinds it before system suspend and binds it again on resume. The DRM device is unregistered and registered again on every suspend and resume cycle, userspace driving the Touch Bar through it (such as tiny-dfr) loses its device, and the Touch Bar stays dark after resume. Implement suspend and resume with drm_mode_config_helper_suspend() and drm_mode_config_helper_resume(), so the device stays registered and the last committed state is restored on resume. If the device was reset while suspended, repeat the probe-time handshake first. Fixes: 0670c2f56e45 ("drm/tiny: add driver for Apple Touch Bars in x86 Macs") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Vasilij Markin <vasilij.kernel@tototo.si> Signed-off-by: Lukas Wunner <lukas@wunner.de> Link: https://patch.msgid.link/20261015-appletbdrm-pm-v3-1-47377176619a@tototo.si
11 daysdrm/bridge: lontium-lt8713sx: Drop redundant bridge funcs assignmentCristian Ciocaltea
The driver already allocates its private data via devm_drm_bridge_alloc(), which initializes the bridge funcs pointer. Remove the leftover manual assignment in the probe function. Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Acked-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20261001-bridge-alloc-conv-v1-2-f0a1fe040a86@collabora.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
11 daysdrm/rockchip: rk3066_hdmi: Convert to devm_drm_bridge_alloc() APICristian Ciocaltea
Bridge drivers are expected to use devm_drm_bridge_alloc() instead of devm_kzalloc() for allocating and partially initializing a private driver struct embedding a struct drm_bridge. Perform the API conversion and drop the now redundant manual initialization of the drm_bridge funcs pointer, following the pattern established by commit 9c399719cfb9 ("drm: convert many bridge drivers from devm_kzalloc() to devm_drm_bridge_alloc() API"). Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com> Acked-by: Maxime Ripard <mripard@kernel.org> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20261001-bridge-alloc-conv-v1-1-f0a1fe040a86@collabora.com Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
11 daysMerge tag 'drm-misc-fixes-2026-10-15' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A revert for the blend mode property patch being applied twice and a patch to reset the device when frozen in virtio, a power state fix for vc4, a Kconfig fix for amdxdna, an error handling, reference counting, and a null pointer dereference fix for rocket, a revert for dma-buf for a commit introducing a dangling reference, a locking fix for exec, and a fix for panthor to handle 10-core GPUs. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@kernel.org> Link: https://patch.msgid.link/atCZfcTvshZx6mcA@houat
12 daysdrm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hangTimur Kristóf
SDMA can randomly hang on Polaris 10. Hard to reproduce, but has been occurring sporadically in the Mesa CI on the RADV Polaris 10 job even when Mesa isn't using the SDMA engine. When Mesa actually uses the SDMA on Polaris, the hang becomes more frequent and the reproduction rate goes up significantly in the CI system. We don't know why the hangs occur, but it seems that inserting a single NOP packet before each POLL_REGMEM and FENCE packet works around it. At the moment it's unclear which GPUs are affected, so let's apply this to SDMA 3.x for now. Note that this issue is not documented or acknowledged by AMD. Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit c343a27ed90823d08de125f7c447d96d056b75d9) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: keep the eviction fence until the last handle is closedJesse Zhang
amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before it checks bo_va->ref_count, so closing any handle of a BO removes the fence, even when the file still has another handle to the BO and the bo_va with its GPU mappings stays. The BO can then be evicted without suspending the user queues of the file, which keep accessing it through mappings that are only marked for update. Seen on navi31 with a SDMA user queue: a BO opened twice in the same file (GEM_FLINK + GEM_OPEN) loses its eviction fence when the second handle is closed (traced attach/detach of the fence): attach bo=ffff8c78a6c84c00 GEM_CLOSE handle=7 detach bo=ffff8c78a6c84c00 while handle 6 and the mapping are still in use. Only detach the fence when the last reference to the bo_va goes away, matching amdgpu_gem_object_open(), which attaches it only when the bo_va is created. With this the fence stays until the file is closed. Fixes: 31f7efcdca4d ("drm/amdgpu: enable eviction fence") Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 8387982f03d4026b7dc11b0b5e3118298eee4d6a) Cc: stable@vger.kernel.org
12 daysdrm/amd/display: Fix NULL sink dereference in USB4 bandwidth functionsSrinivasan Shanmugam
allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both use ASSERT(stream->sink) before dereferencing stream->sink->link. ASSERT is compiled out in production builds, so a NULL stream->sink causes a NULL pointer dereference. link_set_dpms_off() already guards two earlier accesses to stream->sink with explicit NULL checks, confirming that stream->sink can legitimately be NULL. The subsequent call to deallocate_usb4_bandwidth() had no equivalent guard. Replace the ASSERT() calls with proper NULL checks that return false early, and add a matching stream->sink guard at the call site in link_set_dpms_off() consistent with the surrounding pattern. v2: Keep the existing ASSERT() calls for diagnostics (to report unexpected NULL sink), and add explicit NULL checks that return false before dereferencing stream->sink. Also add a matching stream->sink guard at the deallocation call site in link_set_dpms_off(). (Alex) Fixes: 8fa813b7fd1e ("drm/amd/display: Remove sink usage from DPMS") Reported-by: Dan Carpenter <error27@gmail.com> Cc: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com> Cc: Dominik Kaszewski <dominik.kaszewski@amd.com> Cc: George Zhang <george.zhang@amd.com> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com> Cc: Roman Li <Roman.Li@amd.com> Cc: Ivan Lipski <ivan.lipski@amd.com> Cc: Dan Wheeler <daniel.wheeler@amd.com> Cc: Alex Hung <alex.hung@amd.com> Cc: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com> Tested-by: Dan Wheeler <daniel.wheeler@amd.com> Reviewed-by: Roman Li <roman.li@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 98029a0ce61feb52c563f65349dd9b25f672e355) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu/userq: actually validate userq BOsBenjamin Cheng
This was supposed to loop over the individual evicted list, as the kernel and always_valid evicted lists were already handled in amdgpu_vm_validate. Without this, BOs that were created and evicted before a userq was made would never end up in an eviction fence rearm. Also add the missing ref to the BO before drm_exec locks and refs it. Fixes: 4cdbba5a16aa ("drm/amdgpu: restructure VM state machine v4") Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 18decfc9e8cc0fa70b6de9944cc27a37729edfbd) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLESJesse Zhang
The uapi documents drm_amdgpu_gem_list_handles_entry.alignment as "physical start_addr alignment in bytes", and GEM_OP GET_GEM_CREATE_INFO returns the same value in bytes, but GEM_LIST_HANDLES returns tbo.page_alignment, which is in pages. For a BO created with a 64 KiB alignment on navi31: GET_GEM_CREATE_INFO: alignment=65536 GEM_LIST_HANDLES: alignment=16 so a user such as CRIU that recreates BOs from this list uses the wrong alignment. Convert it to bytes. Fixes: f9db1fc52ceb ("drm/amdgpu: Add ioctl to get all gem handles for a process") Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit aa4493ae949c13e79aba0731394dd7a7e431342b) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: free the userptr ranges when a CS fails after parser_bosJesse Zhang
amdgpu_cs_parser_bos() allocates an HMM range for every userptr entry of the BO list and looks up the user pages. Those ranges are only freed when amdgpu_cs_parser_bos() itself fails or when amdgpu_cs_submit() checks them under the notifier lock. If amdgpu_cs_patch_jobs(), amdgpu_cs_vm_handling(), amdgpu_cs_sync_rings() or the early part of amdgpu_cs_submit() fails, nothing frees them: neither amdgpu_cs_parser_fini() nor amdgpu_bo_list_free() touch e->range. Each such CS then leaks the range, its hmm_pfns array (8 bytes per page of the userptr BO) and the BO reference the range holds. An IB on a ring that patches the CS in place (e.g. VCN) with an unmapped va_start fails in amdgpu_cs_patch_ibs() and takes this path. Free the ranges on those error paths. Ranges amdgpu_cs_submit() already dropped are NULL, so freeing them again is a no-op. Fixes: fec8fdb54e8f ("drm/amdgpu: fix userptr HMM range handling v2") Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit c52a9542ed7cfd527feb938bd0accada2ac8d267) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gprJesse Zhang
amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. When copying them to userspace fails, it jumps to the err label, which drops the reference a second time. A read into a bad buffer on Navi31 either steals a reference somebody else holds (power/runtime_usage goes from 1 to 0) or underflows the count: amdgpu 0000:03:00.0: Runtime PM usage count underflow! The registers are already in the kernel buffer at that point, so finish the hardware access first and copy the buffer with a single copy_to_user() instead of the put_user() loop with its own error path. Fixes: 9eee152aab56 ("drm/amdgpu/debugfs: fix ref count leak when pm_runtime_get_sync fails") Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 31035bbd74f7c3e10c163db875b8e67f8b50ee6a) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctlPerry Yuan
When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns -ENOMEM right away and skips the cleanup every other error path goes through. The GEM object, the bo->parent reference on the VM root and the MMU notifier registration are all left behind. Use release_object here, not user_pages_done, range is still NULL at this point. Fixes: e095b55155ef ("drm/amdgpu: use user provided hmm_range buffer in amdgpu_ttm_tt_get_user_pages") Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit bbe739e407a542073ec1a7872b14843566b4919e) Cc: stable@vger.kernel.org
12 daysdrm/amd/pm: add zero fan stop temperature support on smu 14.0.2Kenneth Feng
add zero fan stop temperature support on smu 14.0.2 Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5905 Signed-off-by: Kenneth Feng <kenneth.feng@amd.com> Reviewed-by: Kevin Wang <kevin.wang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit f990c94a2633d0ead477eb1b174e254a6d292e66) Cc: stable@vger.kernel.org
12 daysdrm/amdgpu: destroy mutex when tearing down ttm buffer entityPerry Yuan
Pair mutex_init() with mutex_destroy() on the GART window allocation failure path and in amdgpu_ttm_buffer_entity_fini(). This is a no-op without CONFIG_DEBUG_MUTEXES, but it keeps lockdep from seeing a live mutex after the entity is freed or re-initialized. Signed-off-by: Perry Yuan <perry.yuan@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 03ac40aeed034a0a0d5824ad26f8fbe1f6463698) Cc: stable@vger.kernel.org