summaryrefslogtreecommitdiff
path: root/drivers/gpu
AgeCommit message (Collapse)Author
2026-09-22drm/mali-dp: Fix runtime PM leak in malidp_crtc_atomic_enable()Wentao Liang
malidp_crtc_atomic_enable() resumes the device with pm_runtime_get_sync() and returns early when the resume fails. The runtime PM usage count is incremented by pm_runtime_get_sync() even when the resume fails, so returning without dropping the reference leaks it and, once the error has been hit, prevents the device from ever suspending again. Drop the runtime PM reference with pm_runtime_put_noidle() on the resume failure path before returning. Fixes: 85f6421889ec ("drm: mali-dp: Enable power management for the device.") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang <vulab@iscas.ac.cn> Acked-by: Liviu Dudau <liviu.dudau@arm.com> Link: https://patch.msgid.link/20260916102112.2018372-1-vulab@iscas.ac.cn Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
2026-09-22drm/xe: Add wa_14025941587 to xe2, xe3 and xe3p platformsTangudu Tilak Tirumalesh
Avoid programming the IDLEDLY timer to less than 5 microseconds. Apply wa_14025941587 to Graphics Versions 20.01 to 35.11 and Media Versions 13.01 to 35.03 v2: Use xe_rtp_match_not_sriov_vf, move to local variable Remove warn and other knits - Matt R v3: Add verbose comment - Tejas v4: Restore IDLE_DLY register on engine reset. Add it to GUC save-restore list. -Vivek v5: Extend WA to Media Versions 13.01 to 35.03 - Vinay v6: Avoid clearing inhibit switch - Bala Refactor code accordingly by adding idle_reg_val. v7: Rebased with the divide-by-zero/overflow guards living in a separate hardening patch. v8: Preserve the Wa_16023105232 floor (DIV_ROUND_DOWN_ULL) and the maxcnt == 0 guard from the hardening patch. Round up (DIV_ROUND_UP_ULL) the Wa_14025941587 minimum conversion instead, so the tick-quantized delay cannot round back below 5 us. v9: Evaluate the Wa_16023105232 xe_gt_WARN_ON() against the value read from hardware instead of the Wa_14025941587-bumped value, so it no longer fires on the driver's own floor. Re-check the rounded-up tick value against maxcnt and floor it if tick quantization pushed it back to/above maxcnt, logging via xe_gt_dbg since this is the driver's own value, not a hardware anomaly. Assisted-by: GitHub_Copilot:claude-opus-4.8 Signed-off-by: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com> Reviewed-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com> Link: https://patch.msgid.link/20260916100545.779894-3-tilak.tirumalesh.tangudu@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-09-22drm/xe: harden adjust_idledly() against divide-by-zero and overflowTangudu Tilak Tirumalesh
adjust_idledly() has several corner-case issues flagged during review: 1. If xe_gt_clock_init() failed to recognise the crystal clock, gt->info.timestamp_base is 0, which makes idledly_units_ps also 0. The subsequent DIV_ROUND_CLOSEST(..., idledly_units_ps) is then a divide-by-zero and panics the kernel. 2. The tick-to-ns conversions are done in u32: idledly * idledly_units_ps, (maxcnt - 1) * 1000 Both overflow u32 before DIV_ROUND_CLOSEST() sees them. 3. If IDLE_WAIT_TIME reads back as 0, maxcnt evaluates to 0 and the maxcnt - 1 clamp wraps to 0xFFFFFFFF in u32. 4. The register only stores whole ticks, so the clamped ns value has to be converted to ticks and back. DIV_ROUND_CLOSEST() can round that conversion up past maxcnt: maxcnt = 640 ns, one tick = 666664 ps clamp: maxcnt - 1 = 639 ns ns -> ticks: 639000 / 666664 = 0.958 -> rounds to 1 tick tick -> ns: 1 * 666664 / 1000 = 667 ns 667 ns is programmed into RING_IDLEDLY, but 667 >= maxcnt (640), so xe_gt_WARN_ON() fires again on every subsequent init. Return early if timestamp_base is 0 (the unknown-crystal path). Do the conversions in u64 via the *_ULL() helpers so they cannot wrap. Clamp with a floor (DIV_ROUND_DOWN_ULL) so the programmed delay stays strictly below maxcnt, and guard the maxcnt == 0 case with a zero delay while still writing RING_IDLEDLY so INHIBIT_SWITCH_UNTIL_PREEMPTED is cleared. v2: Drop the redundant warn on the timestamp_base == 0 path; xe_gt_clock_init() already warns on an unrecognised crystal clock. Keep the early return to avoid the divide-by-zero. - Vinay v3: Field-mask the RING_IDLEDLY write with REG_FIELD_PREP(IDLE_DELAY, ...) instead of writing the raw tick count, which could clobber INHIBIT_SWITCH_UNTIL_PREEMPTED and reserved bits. Split the inhibit-switch clear from the maxcnt clamp so a set inhibit bit no longer forces a needless delay overwrite when the delay itself is already valid. Use gt_to_xe(gt) instead of gt_to_xe(hwe->gt). Fixes: d2de4410a88f ("drm/xe: Apply Wa_16023105232") Cc: stable@vger.kernel.org Assisted-by: GitHub_Copilot:claude-opus-4.8 Signed-off-by: Tangudu Tilak Tirumalesh <tilak.tirumalesh.tangudu@intel.com> Reviewed-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com> Link: https://patch.msgid.link/20260916100545.779894-2-tilak.tirumalesh.tangudu@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
2026-09-22drm/i915/psr: switch to drm_dp_dpcd_{read_byte, read_data, write_byte, ↵Jani Nikula
write_data}() Switch to the modern DPCD access functions that return negative error codes on errors, -EIO for incomplete access, and 0 on success. This flags incomplete reads, and clarifies error handling all over the place. Use 1-byte accessors where sensible. Rename local int r to ret for clarity and consistency. Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/0a32cfdb64a37e586579a689bd8c3c4944596a31.1789547331.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/dp-test: switch to drm_dp_dpcd_{read_byte, read_data, write_byte, ↵Jani Nikula
write_data}() Switch to the modern DPCD access functions that return negative error codes on errors, -EIO for incomplete access, and 0 on success. This flags incomplete reads, and simplifies error handling all over the place. Rename local int status to ret for clarity and consistency. Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/ddf90aeb0dae3779d92381f550d95111398e7e02.1789547331.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/dp-mst: switch to drm_dp_dpcd_read_byte()Jani Nikula
Switch to the modern DPCD access functions that return negative error codes on errors, -EIO for incomplete access, and 0 on success. Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/26dfbd4d99f86c19efbff89613728ab967ec4f67.1789547331.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/dp: switch link training to drm_dp_dpcd_{read_byte, read_data, ↵Jani Nikula
write_byte, write_data}() Switch to the modern DPCD access functions that return negative error codes on errors, -EIO for incomplete access, and 0 on success. Use local ret variables for the return value instead of checking inline, where sensible. Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/c88130676c7b8187a5e5954cdbd36c316950d89f.1789547331.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/hdcp: switch to drm_dp_dpcd_{read_byte, read_data, write_data}()Jani Nikula
Switch to the modern DPCD access functions that return negative error codes on errors, -EIO for incomplete access, and 0 on success. This simplifies error handling all over the place. Convert the error logging to use %pe and ERR_PTR() while at it. Add comments to the read/write places that depend on the functions that return the number of bytes read/written for incomplete access. v2: return length from get_receiver_id_list_rx_info() (Sashiko) Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260921094103.701841-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/dp: switch to drm_dp_dpcd_{read_byte, read_data, write_byte, ↵Jani Nikula
write_data} Switch to the modern DPCD access functions that return negative error codes on errors, -EIO for incomplete access, and 0 on success. Use local ret variables for the return value instead of checking inline, where sensible. Rename local int err to ret for clarity and consistency. Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/ad0a642c726436b5d41f2315e1c431d65fe2ea24.1789547331.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/lspcon: switch to drm_dp_dpcd_{read_byte, read_data, write_byte, ↵Jani Nikula
write_data}() Switch to the modern DPCD access functions that return negative error codes on errors, -EIO for incomplete access, and 0 on success. Use local ret variables for the return value instead of checking inline. Use %pe and ERR_PTR() for logging the errors. Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/f16cb57607634d411a42ca6cd80b10a713d7677f.1789547331.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/ddi: switch to drm_dp_dpcd_write_byte()Jani Nikula
Switch to the modern DPCD access functions that return negative error codes on errors, -EIO for incomplete access, and 0 on success. Use local ret variables for the return value instead of checking inline where sensible. This improves clarity. Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/f0652fabfd6143680decd826ec74cd5d1116195f.1789547331.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/alpm: switch to drm_dp_dpcd_{read_byte, write_byte}Jani Nikula
Switch to the modern DPCD access functions that return negative error codes on errors, -EIO for incomplete access, and 0 on success. Rename an int r to ret while at it for clarity. Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/67868fd8a8c8e057ba82c4b142fabae2d0fa52d6.1789547331.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/lspcon: switch to drm_dp_dpcd_{read_byte, write_byte, write_data}Jani Nikula
Switch to the modern DPCD access functions that return negative error codes on errors, -EIO for incomplete access, and 0 on success. Use 1-byte accessors where sensible. Use local ret variables for the return value instead of checking inline. Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/a890746215c6c7a1e36a6bc880ae644dd06f1956.1789547331.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/lspcon: use u8 variable to hold 1-byte DPCD readsJani Nikula
Passing a pointer to a u32 variable for a 1-byte reads is error prone, and only works because it's always initialized to 0 before the read, and the code's running on little-endian CPUs. Switch to u8 variables. In _lspcon_write_avi_infoframe_mca(), add a separate variable to hold the number of bytes written instead of reusing the same variable for two purposes. Reviewed-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/66a74267a3da7619dda8dc2b1bb1bfcedc25df0d.1789547331.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22gpu: nova-core: gsp: give the command queue its own BAR0 mappingJohn Hubbard
Sending a command to the GSP ends by writing the GSP doorbell, a BAR0 register, so every send path through the command queue needs the BAR0 mapping. A command too large for one queue element goes out as a first element followed by continuation records, so the send path has four functions. Nova-core passed the mapping down from the caller as an argument, which was threaded through all four functions, and every caller of a send had to carry it as well. Store the mapping in the command queue and drop the argument. The queue lives exactly as long as the mapping does, since both belong to the bound device. Suggested-by: Alexandre Courbot <acourbot@nvidia.com> Assisted-by: LLM Signed-off-by: John Hubbard <jhubbard@nvidia.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260918010719.1176945-4-jhubbard@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-09-22gpu: nova-core: set MCTP transport header version to 1John Hubbard
FSP, the GPU's Foundation Security Processor, receives the driver's messages as packets of MCTP, the Management Component Transport Protocol. It requires header version 1 in bits 3:0 of the MCTP transport header. Nova-core left those bits at zero, so every Chain of Trust request and every Product Reconfiguration Control request that it sent carried an invalid transport header. Declare the version field and set it. Declare the destination endpoint ID field as well. The driver leaves that field at zero. Assisted-by: LLM Signed-off-by: John Hubbard <jhubbard@nvidia.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Reviewed-by: Zhi Wang <zhiw@nvidia.com> Link: https://patch.msgid.link/20260918010719.1176945-3-jhubbard@nvidia.com [acourbot: explicitly set deid field] Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-09-22gpu: nova-core: rename the FbRanges elf field to fw_imageJohn Hubbard
A TLV firmware file carries the GSP firmware image as a section extracted from the original ELF, and the section is not itself an ELF. Before the driver moved to TLV firmware files, it parsed that ELF itself, and it named the framebuffer range that holds the image for the ELF. The range kept the name through the move. Rename the field for the framebuffer range that holds the GSP firmware image, from elf to fw_image. After this, the following: $ cd drivers/gpu/nova-core $ grep -iw ELF comes up empty. :) Assisted-by: LLM Signed-off-by: John Hubbard <jhubbard@nvidia.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260913195413.742143-4-jhubbard@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-09-22gpu: nova-core: zero-pad radix3 page table levels to page boundaryJohn Hubbard
On Turing through Ada, the booter, a firmware stage that runs on the GPU's SEC2 falcon, copies the GSP firmware image from system memory into the framebuffer. It walks the radix3 table to find each page of the image, and it reads each level of the table by DMA, a whole 4 KiB page at a time. The last page of a level is only partly filled with entries, so the bytes past the last entry reach the booter too. Nova-core allocated each level at the size of its entries and wrote only the entries, so the rest of the level's last page held whatever the allocator left there, and the booter read that stale kernel memory. Allocate each level zeroed and sized to a whole number of 4 KiB pages, as Open RM does, and write the entries into it. Assisted-by: LLM Signed-off-by: John Hubbard <jhubbard@nvidia.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260913195413.742143-3-jhubbard@nvidia.com [acourbot: move chunks from previous commit into this one for consistency] Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-09-22gpu: nova-core: revise radix3 documentation and commentsJohn Hubbard
Describe the reusable buffer mapping in module documentation and update the relevant descriptions. [acourbot: split the original patch into logical changes.] Assisted-by: LLM Signed-off-by: John Hubbard <jhubbard@nvidia.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260913195413.742143-2-jhubbard@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-09-22gpu: nova-core: generalize radix3 buffer namesJohn Hubbard
The extracted table builder can map buffers other than the GSP firmware image. Rename its `fw` field and `fw_vvec` parameter to `data`, updating the existing documentation references to match. [acourbot: split the original patch into logical changes.] Assisted-by: LLM Signed-off-by: John Hubbard <jhubbard@nvidia.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260913195413.742143-2-jhubbard@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-09-22gpu: nova-core: extract radix3 page table into its own moduleJohn Hubbard
In order to boot the GSP, nova-core loads the GSP firmware image into system memory, and the GPU copies it into the framebuffer, the GPU's own memory. The GPU finds the GSP firmware image's pages via "radix3", a three-level page table of 4 KiB pages that the driver builds. Today the table exists as fields within the GSP firmware wrapper, which is fine because there is only one radix3 consumer. The upcoming r000 series[1], however, introduces a second radix3 caller: the ucodes firmware image. That is because the GSP has been changed, so that it automatically fetches the subset of ucodes that it requires, thus reducing the size of the GSP image. This is a helpful change for the firmware situation overall, but it will require nova-core to load and provide ucodes, in much the same way that it was loading and providing the GSP firmware image. Therefore, split out radix3 into its own module. [1] https://lore.kernel.org/all/20260822015448.238214-1-jhubbard@nvidia.com/ [acourbot: keep only the mechanical move, split other changes into distinct commits] Assisted-by: LLM Signed-off-by: John Hubbard <jhubbard@nvidia.com> Reviewed-by: Timur Tabi <ttabi@nvidia.com> Link: https://patch.msgid.link/20260913195413.742143-2-jhubbard@nvidia.com Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
2026-09-22drm/i915/fbc: remove uint16 from supported fbc formats in xe3plpdVinod Govindapillai
As UINT16 pixel formats are not listed as supported formats in any of the display versions so far, there is no point is having these formats listed as supported for FBC. So remove the UINT16 formats from the supported formats for FBC. v2: removed an unused variable Signed-off-by: Vinod Govindapillai <vinod.govindapillai@intel.com> Reviewed-by: Mika Kahola <mika.kahola@intel.com> Link: https://patch.msgid.link/20260916195602.939242-1-vinod.govindapillai@intel.com
2026-09-22Merge drm/drm-next into drm-misc-nextThomas Zimmermann
Backmerging drm/drm-next into drm-misc-next to get fixes from v7.3-rc4. Required for commit 2ab510e63197 ("drm/sched: Fix virtual runtime race"). Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2026-09-22drm/i915/vrr: Disable DC balance by defaultMitul Golani
Disable VRR DC balance by default due to timing issues observed on some panel/TCON combinations. Keep the module parameter to enable DC balance during debugging and to isolate DC balance effects from underlying VRR/display timing issues. --v2: - Make enable_dc_balance a bool and keep it disabled by default; fix the parameter type/value mismatch and correct the description (Chaitanya Kumar Borah, Jani Nikula) - Explain in the commit message why the feature is gated and why a module parameter is used (Jani Nikula) --v3: - Commit message update (Jani Nikula) Fixes: 555819270707 ("drm/i915/vrr: Enable DC Balance") Cc: <stable@vger.kernel.org> # v7.0+ Signed-off-by: Mitul Golani <mitulkumar.ajitkumar.golani@intel.com> Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260917074322.2606738-1-mitulkumar.ajitkumar.golani@intel.com
2026-09-22drm/i915: fix incorrect RCU teardown orderChristian König
i915_gem_busy_ioctl uses dma_resv_for_each_fence_unlocked() to iterate over the fences in an GEM object without holding a reference but only the RCU read side lock. What can happen here is that the GEM object is destroyed concurrently while i915_gem_busy_ioctl is still running. This won't free the GEM objects memory, but still drops all the dma_fence references. Now when dma_resv_for_each_fence_unlocked() sees a destroyed dma_fence it assumes that a new fence list was installed and re-starts the loop. But in the case of a destroyed GEM object a new fence list is never installed, only the old one freed and therefore the iteration never finishes resulting in an endless loop. The solution is to drop the fence references only after the RCU grace period. The fixes tag is not necessary the patch introducing the problem, but the one making it so worse that we need to address it. This problem was pointed out by Sashiko-bot. Signed-off-by: Christian König <christian.koenig@amd.com> Fixes: 912ff2ebd695 ("drm/i915: use the new iterator in i915_gem_busy_ioctl v2") CC: stable@vger.kernel.org Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260903113621.54660-1-christian.koenig@amd.com (cherry picked from commit 5113479556025093bf8133bb2dcaa33be2d50921) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/dp: use EXPORT_SYMBOL_IF_KUNIT() for kunit helpersJani Nikula
Use EXPORT_SYMBOL_IF_KUNIT() instead of the regular EXPORT_SYMBOL() to export the symbols to the kunit namespace. Otherwise, the symbols get exported for all the kernel to see, and the corresponding MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING") in the tests is meaningless. Fixes: 2eb9982ff179 ("drm/i915/kunit: Export link training and caps funcs for testing") Cc: Imre Deak <imre.deak@intel.com> Reviewed-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260915160620.779372-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com> (cherry picked from commit 4ffdb772716e4279d63dfaaadf965da73e799aeb)
2026-09-22drm/i915/dp_mst: Fix configuring TUs for a disconnected streamImre Deak
During an atomic commit after all the MST stream CRTC state is computed the driver ensures that the sum of TUs of all the streams on a given MST topology link is within limits (63 for 8b10 and 64 for 128b132b). For a disconnected stream the DRM MST core's BW verification doesn't ensure this, because the topology state it uses for this is destroyed as soon as the stream (i.e. MST connector/port) is disconnected. The driver should keep the link state valid even for such disconnected streams, as userspace may disable them one-by-one only in a deferred way. Ensure the link's sum of TUs stays within limits in this case by simply reusing the maximum link BPP limit from the stream's (i.e. CRTC's) old state. The disconnection can happen either via the whole topology getting disconnected or via only the given stream's port getting disconnected. Check for both of these conditions separately, as a connector gets unregistered after a link disconnect event only in a deferred way. Cc: stable@vger.kernel.org # v6.10+ Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16073 Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16384 Reviewed-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260907174413.741851-2-imre.deak@intel.com (cherry picked from commit ee00f8fbb2b202002ab90834e02e9ba372773a36) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/dp_mst: Fix configuring FEC for a disconnected streamImre Deak
During an atomic commit after all the MST stream CRTC state is computed the driver ensures that the FEC is configured the same way (enabled or disabled) for all the streams on a given MST topology's link. drm_dp_mst_port_downstream_of_parent() used to determine if a stream is downstream of an MST port will return false if the whole topology is disconnected, since in that case it can't verify that the port/ parent_port passed to it is in the given MST topology. This is a problem during the above FEC configuration check, since intel_dp_mst_check_dsc_change()->get_pipes_downstream_of_mst_ports() will not return all the stream CRTCs/pipes for the topology as expected. Since passing parent_port==NULL to get_pipes_downstream_of_mst_port() is meant to return all the streams for the given topology (i.e. mst_mgr) skip checking if an MST port is downstream of a parent port in this case. This fixes a problem where the FEC configuration check explained above failed to ensure that all streams' FEC is configured the same way if the topology was disconnected, leading to a FEC state mismatch error. Cc: stable@vger.kernel.org # v6.10+ Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16073 Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16384 Reviewed-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Imre Deak <imre.deak@intel.com> Link: https://patch.msgid.link/20260907174413.741851-1-imre.deak@intel.com (cherry picked from commit 270681fbffbba2b6ccf5b7e3c34b8b563b36167f) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/quirks: Limit eDP rate to HBR2 on HP Pavilion Plus 14-ew1Ankit Nautiyal
The eDP panel on the HP Pavilion Plus Laptop 14-ew1xxx advertises HBR3 while leaving the TPS4 support bit clear. The output however flickers, once link is trained with HBR3. Until commit 8c9006283e4b ("Revert "drm/i915/dp: Reject HBR3 when sink doesn't support TPS4"") such sinks were capped at HBR2 by the TPS4 check which incidentally kept this panel stable. That check was reverted because other panels legitimately need HBR3 without advertising TPS4, and the per-machine QUIRK_EDP_LIMIT_RATE_HBR2 was introduced to handle the affected machines instead. Add the machine to the list of devices that need the QUIRK_EDP_LIMIT_RATE_HBR2. Fixes: 8c9006283e4b ("Revert "drm/i915/dp: Reject HBR3 when sink doesn't support TPS4"") Reported-by: Annoy Cc <annoycc@gmail.com> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16743 Cc: <stable@vger.kernel.org> # v6.18+ Tested-by: Annoy Cc <annoycc@gmail.com> Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Reviewed-by: Nemesa Garg <nemesa.garg@intel.com> Link: https://patch.msgid.link/20260907034555.2753846-1-ankit.k.nautiyal@intel.com (cherry picked from commit 550b703fdbb2a2022faa75b4b11ab135241afbd9) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22drm/i915/psr: Clear stale sel fetch enable bits on sel fetch disableNemesa Garg
Selective fetch is dropped while pipe CRC is active, and the planes keep their SEL_FETCH_PLANE_CTL / SEL_FETCH_CUR_CTL enable bit set in hardware over that. A plane disabled while selective fetch is off never gets the bit cleared, as the disable path is guarded by enable_psr2_sel_fetch. Once selective fetch comes back the hardware resumes fetching for a plane that is no longer enabled and keeps its DDB range reserved. Clear the bits as selective fetch is turned off instead. Atomic check has both the old and the new crtc state, so record the transition there and let the plane and cursor arm paths write the registers to 0 for that commit. v2: Drop the old_crtc_state->hw.active check. [Jouni] Fixes: b1f5279b5981 ("drm/i915/psr: Move plane sel fetch configuration into plane source files") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8739 Assisted-by: Copilot:Claude-Opus-5 Signed-off-by: Nemesa Garg <nemesa.garg@intel.com> Reviewed-by: Jouni Högander <jouni.hogander@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Link: https://patch.msgid.link/20260909110332.3528029-3-nemesa.garg@intel.com (cherry picked from commit a4c0e7f80429eda6990960971aebd4e4b9533cc6) Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-22Backmerge tag 'v7.3-rc4' into drm-nextDave Airlie
Linux 7.3-rc4 Requested by Philipp Stanner for 2ab510e63197360945f915dd5631a77c63ac6b27 would be needed as a groundlayer for further patches that extend the locking in drm_sched Signed-off-by: Dave Airlie <airlied@redhat.com>
2026-09-22Merge tag 'drm-xe-next-2026-09-18' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - Add SRCID to pagefault reporting (Jonathan) Cross-subsystem Changes: - gpusvm: share one HMM fault and keep single mappings inline (Honglei) - pagemap: Prevent CPU stalls during unbounded pagemap teardown (Varun) Driver Changes: - VRAM health check + CCS fix (Auld) - Add memory page offlining support (Tejas) - Report GT TDR and VM rebind faults using SIGID (Arvind) - Flush LSC untyped L1 dataport cache after rcs/ccs batches (Thomas) - Add multi_queue_active_lrca debugfs (Varun) - mmio_gem: fix fault handler and destroy path (Auld, Ilia, Shuicheng) - sysctrl: Add helper to query application status (Anoop) - shrinker: Runtime PM reference for non-system memory (Shuicheng) - pcode: Increase default mailbox timeout (Karthik) - Skip clearing purged page-table BOs (Tejas) - tests: Fix subplatform selection (Wajdeczko) - log: Relax location ID recognition (Wajdeczko) - i2c: Disable IRQ on unbind (Raag) - Refactor VF LMEM BAR resize helper function (Wajdeczko) - pf: Add _locked variant of config functions (Wajdeczko) - nvm: add system controller region (Alexander) - guc: Add simple KLV decoder helpers (Wajdeczko) - debugfs: Expose per-engine idle status (Anirban) - gt_throttle: Report power brake as a throttle reason on CRI (Anirban) - tlb_inval: Treat wedged-device invalidations as complete (Shuicheng) - Add mnemonic error reason to page fault diagnostics (Brost) - Keep walking on SVM eviction failure (Brost) - Make p2pdma distance check verbose via dynamic debug (Thomas) - Consolidate semaphore instruction definitions (Roper) - Poll GT for C6 before D3 (Vinay) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/aq2UzTdN95ZpzKGz@gsse-cloud1.jf.intel.com
2026-09-22Merge tag 'amd-drm-next-7.4-2026-09-17' of ↵Dave Airlie
https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-next [airlied: fix two merge conflicts] amd-drm-next-7.4-2026-09-17: amdgpu: - SMU 14.x fix - DC IRQ fix - Runtime PM fix for P2P - RAS fix - PCIe reporting fix - DCN 6 fix - Device removal fix - DC MALL fix - Display KUNIT test fixes - More display KUNIT tests - GC 12.1 cleanup - DC RMCM refactor - Display forces RGB fix - DP MST fixes - USB4 fixes - Plane update fixes - DMUB updates - ISM fixes - DCN 4.2 updates - HDMI FRL updates - Add new trace events - SDMA soft reset updates - Update git trees in MAINTAINERS - UALink fixes - UserQ fixes - SDMA clean ups - Misc spelling fixes - Documentation fixes - ATOM range checks amdkfd: - GC 12.x fixes - Boundary checks - Mapping clear fix - GC 10 CU occupancy support - GC 12.1 fixes - XNACK fix - Partition fix radeon: - eDP fix for DCE3.2 iMacs Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260917203841.3881294-1-alexander.deucher@amd.com
2026-09-21drm/v3d: Restrict v3d_perfmon_stop_locked() to v3d_perfmon.cErick Karanja
v3d_perfmon_stop_locked() is only used within v3d_perfmon.c. Make the function file-local and remove its declaration from v3d_drv.h. Signed-off-by: Erick Karanja <karanja99erick@gmail.com> Link: https://patch.msgid.link/20260921190014.38231-1-karanja99erick@gmail.com Reviewed-by: Maíra Canal <mcanal@igalia.com> Signed-off-by: Maíra Canal <mcanal@igalia.com>
2026-09-21drm/xe/pf: Move locking to xe_sriov_pf_reprovision_defaultMichal Wajdeczko
We should avoid taking the mutex in the helpers. Move guard from the helper to the main entry function. Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com> Link: https://patch.msgid.link/20260916212949.13120-1-michal.wajdeczko@intel.com
2026-09-21drm/panel-edp: add CSOT MNE007QB1-1 entrySrinivas Kandagatla
14" 1920x1200 IPS panel used on Lenovo ThinkPad T14s Gen 7 (Mahua). The panel identifies as CSW 0x1465 over eDP AUX and is not in edp_panels[] today, so probe falls back to conservative timings. EDID, read over the panel's DP AUX DDC bus: 00 ff ff ff ff ff ff 00 0e 77 65 14 00 00 00 00 00 23 01 04 a5 1e 13 78 07 37 3a a3 55 4d 9c 25 0c 50 55 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 35 3c 80 a0 70 b0 23 40 30 20 66 00 2d bc 10 00 00 18 00 00 00 fd 00 1e 3c 4a 4a 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 43 53 4f 54 20 54 33 0a 20 20 20 20 20 00 00 00 fc 00 4d 4e 45 30 30 37 51 42 31 2d 31 0a 20 01 6a 70 20 79 02 00 20 00 0c 40 8b f6 65 14 00 00 00 00 00 19 00 21 00 1d c8 0b 5d 07 80 07 b0 04 00 3d 7a 54 cc 94 99 66 52 0f 02 35 54 00 80 00 80 00 80 12 78 26 00 09 02 00 00 00 00 00 01 00 00 22 00 14 0f 5a 02 05 7f 07 9f 00 2f 00 1f 00 af 04 22 00 05 00 05 00 81 00 15 74 1a 00 00 03 51 1e 3c 00 00 00 00 00 00 3c 00 00 00 00 8d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 90 Manufacturer: CSW Model: 0x1465 Made in: 2025 Display Product Name: 'MNE007QB1-1' ASCII String: 'CSOT T3' DTD 1: 1920x1200 60.006199 Hz 16:10 (302 mm x 189 mm) Datasheet was not available, so timings are not datasheet-derived. The delay_200_500_e50 preset matches the sibling CSOT MNE007QB/QS entries already in the file. Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Douglas Anderson <dianders@chromium.org> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260918120515.595782-3-srinivas.kandagatla@oss.qualcomm.com
2026-09-21drm/xe: Limit sg segment size to PAGE_SIZE on Xen PVSzymon Acedański
Fix display corruption on Xen PV dom0, where DMA buffers are not guaranteed machine-contiguous, in which case bounce buffering kicks in, breaking xe's memory coherency assumptions. Apply the same workaround i915 carries in i915_sg_segment_size() since commit 78a07fe777c4 ("drm/i915: stop abusing swiotlb_max_segment"). Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8382 Link: https://lore.kernel.org/xen-devel/aYtznP_tT6xNPwf-@mail-itl/ Link: https://lore.kernel.org/all/20221020110308.1582518-1-hch@lst.de/ # i915 counterpart Cc: Christoph Hellwig <hch@lst.de> Cc: Robert Beckett <bob.beckett@collabora.com> Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Szymon Acedański <accek@invisiblethingslab.com> Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/20260916173030.3223833-1-accek@invisiblethingslab.com
2026-09-21drm/xe/vm: nuke PTs only after unlinking contested VMAsMatthew Auld
In xe_vm_close_and_put(), external-BO VMAs are queued on the contested list for deferred destruction via xe_vma_destroy_unlocked(). However, xe_vm_pt_destroy() was previously invoked before processing contested VMAs, destroying vm->pt_root while those VMAs were still linked to their respective buffer objects (vm_bo->list.gpuva). If a concurrent thread evicts one of those shared buffer objects, xe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in fault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because vm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a NULL ptr deref. Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until after all contested VMAs have been unlinked and destroyed. User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which could be explained by this race. Assisted-by: LLM Fixes: b06d47be7c83 ("drm/xe: Port Xe to GPUVA") Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/9290 Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: <stable@vger.kernel.org> # v6.12+ Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260918131034.598078-2-matthew.auld@intel.com (cherry picked from commit c2863648959489767f08892fd6e90577d2ea0b6a) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-09-21drm/xe: Keep walking on SVM eviction failureMatthew Brost
The desired behavior for SVM eviction failures, which can occur due to various uncontrollable races, is for TTM to continue walking the LRU list and look for another eviction candidate. This is expressed by returning -ENOSPC from the ->move() callback. Adjust the SVM eviction failure path because of races in ->move() to return -ENOSPC so that TTM continues searching for another buffer to evict. Fixes: 3ca608dc7561 ("drm/xe: Basic SVM BO eviction") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost@intel.com> Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com> Link: https://patch.msgid.link/20260917203158.292823-1-matthew.brost@intel.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> (cherry picked from commit 36a86c23588b8f57c9d20feb4cf5a2ab27e3baba) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-09-21drm/xe/tlb_inval: Treat wedged-device invalidations as completeShuicheng Lin
A TLB invalidation issued on a wedged device fails with -ENOTRECOVERABLE. xe_tlb_inval_issue() squashes only -ECANCELED, so the error reaches callers that treat it as unexpected and WARN, tainting the kernel on a wedge that was deliberately caused: ggtt_invalidate_gt_tlb() drivers/gpu/drm/xe/xe_ggtt.c xe_svm_invalidate() drivers/gpu/drm/xe/xe_svm.c xe_bo_trigger_rebind() drivers/gpu/drm/xe/xe_bo.c xe_vma_userptr_do_inval() drivers/gpu/drm/xe/xe_userptr.c igt@xe_exec_reset@gt-reset-fault-injection hits the GGTT one, turning an otherwise passing run into an abort: *ERROR* SIGID=102 FATAL (-EIO) WEDGED: Device declared wedged! Tile0: GT1: Failed to invalidate GGTT (-ENOTRECOVERABLE) WARNING: drivers/gpu/drm/xe/xe_ggtt.c:588 at ggtt_invalidate_gt_tlb Workqueue: xe-guc-destroy-wq __guc_exec_queue_destroy_async [xe] ggtt_node_remove+0xe3/0x100 [xe] xe_ggtt_remove_bo+0x89/0x2c0 [xe] xe_ttm_bo_destroy+0xcb/0x330 [xe] ... xe_lrc_destroy+0x74/0x90 [xe] xe_exec_queue_fini+0x2d/0x60 [xe] -ECANCELED and -ENOTRECOVERABLE mean the same thing at this layer: the message was dropped rather than delivered, and the fence has already been signalled before the error is returned, so there is nothing left to wait for. Squash both. A wedged device is only recovered by a fresh initialisation, so the error return in xe_bo_trigger_rebind() becomes unreachable by design. v2: fix all invalidation paths. (Sashiko) Fixes: 50fa9acac26f ("drm/xe/guc: distinguish wedged from recoverable cancellation") Assisted-by: Claude:claude-opus-5 Cc: Sk Anirban <sk.anirban@intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260914215318.200603-1-shuicheng.lin@intel.com (cherry picked from commit af14e3705345cb57c53b237169873233052a5c16) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-09-21drm/xe/gt_throttle: Report power brake as a throttle reason on CRISk Anirban
CRI defines bit 5 of the perf limit reasons register as a power brake (PWRBRK) indicator. Add PWRBRK_MASK and a reason_pwrbrk sysfs attribute for CRI in place of reason_ratl. Signed-off-by: Sk Anirban <sk.anirban@intel.com> Fixes: 8578e6d0546c ("drm/xe/gt_throttle: Drop individual show functions") Reviewed-by: Raag Jadav <raag.jadav@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260909114931.1039331-2-sk.anirban@intel.com (cherry picked from commit e199c851c0ab608a0ca89e7be1756a1461b41a2c) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-09-21drm/i915/dp: Handle VSC SDP revision 7 in unpackJuasheem Sultan
VSC SDP revision 7 (Panel Replay + Pixel Encoding/Colorimetry Format) unpacking is missing in intel_dp_vsc_sdp_unpack(). This causes pipe state mismatches during state readout because the VSC SDP state is not properly recovered when Panel Replay is active with colorimetry. Add the missing case for revision 7 to intel_dp_vsc_sdp_unpack() so that the state is correctly recovered. v2: Rebase onto latest upstream v3: Fix git commit description Cc: Jani Nikula <jani.nikula@linux.intel.com> Cc: Chaitanya Borah <chaitanya.kumar.borah@intel.com> Cc: Gil Dekel <gildekel@google.com> Signed-off-by: Juasheem Sultan <jdsultan@google.com> Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com> Link: https://patch.msgid.link/20260602205422.1792007-1-jdsultan@google.com
2026-09-21drm/i915: use string choice helpersLalit Shankar Chowdhury
Prefer the str_high_low() and str_read_write() helper functions over ternary operators with hardcoded strings. No functional changes. Signed-off-by: Lalit Shankar Chowdhury <lalitshankarch@gmail.com> Reviewed-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/20260918042325.17700-1-lalitshankarch@gmail.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2026-09-21drm/imagination: Add job type info to pvr_job_submit_fw trace eventBrajesh Gupta
Update trace event pvr_job_submit_fw to additionally capture and display type of the submitted job to easily map events as per type. Reviewed-by: Alexandru Dadu <alexandru.dadu@imgtec.com> Reviewed-by: Alessio Belle <alessio.belle@imgtec.com> Link: https://patch.msgid.link/20260918-b4-submitjob_tracepoint-v2-1-d9b104de07b8@imgtec.com Signed-off-by: Brajesh Gupta <brajesh.gupta@imgtec.com>
2026-09-21drm/omap: dsi: print errors with device prefixAndreas Kemnade
There are two dsi controllers on OMAP4/5. If both are in use, messages without device prefix have no indication which controller they are coming from. That makes debugging harder. Replace DSSERR/DBG macros with dev_-prefixed print functions where the device is reliably accessible. Also replace function names by %s ... __func__ constructs and remove some debug outputs to satisfy checkpatch. Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260908172213.446608-1-andreas@kemnade.info Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-09-21drm/xe/vm: nuke PTs only after unlinking contested VMAsMatthew Auld
In xe_vm_close_and_put(), external-BO VMAs are queued on the contested list for deferred destruction via xe_vma_destroy_unlocked(). However, xe_vm_pt_destroy() was previously invoked before processing contested VMAs, destroying vm->pt_root while those VMAs were still linked to their respective buffer objects (vm_bo->list.gpuva). If a concurrent thread evicts one of those shared buffer objects, xe_bo_trigger_rebind() holding only bo->resv walks the BO's VMAs and, in fault mode, calls xe_vm_invalidate_vma() -> xe_pt_zap_ptes(). Because vm->pt_root[tile->id] is already NULL, dereferencing pt->level causes a NULL ptr deref. Fix this by deferring xe_vm_free_scratch() and xe_vm_pt_destroy() until after all contested VMAs have been unlinked and destroyed. User is reporting hitting a NULL ptr deref in xe_pt_zap_ptes(), which could be explained by this race. Assisted-by: LLM Fixes: b06d47be7c83 ("drm/xe: Port Xe to GPUVA") Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/9290 Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Matthew Brost <matthew.brost@intel.com> Cc: <stable@vger.kernel.org> # v6.12+ Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260918131034.598078-2-matthew.auld@intel.com
2026-09-21drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attachLi Youhong
When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiod_get_optional() to devm_gpiod_get_optional() while keeping the matching gpiod_put() calls. That combination is wrong for a managed descriptor. However, dropping the puts and keeping the managed get is also wrong: samsung_dsim_register_te_irq() runs from the DSI host attach callback, and host detach/reattach can happen without destroying the device that owns the managed action. A second attach would then request the GPIO again without having released it. Switch back to a non-managed gpiod_get_optional() and keep the explicit gpiod_put() on the request_irq() error path and in samsung_dsim_unregister_te_irq(). Fixes: e7447128ca4a ("drm: bridge: Generalize Exynos-DSI driver into a Samsung DSIM bridge") Suggested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Li Youhong <liyouhong@kylinos.cn> Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Link: https://patch.msgid.link/20260904014958.1572918-1-dayou5941@163.com [Luca: remove unnecessary comment] Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
2026-09-21drm/i915/xe3plpd: Map AUX power domains to DC_offSuraj Kandpal
From Xe2Lpd we removed the step to disable DC5/6 because as per Bspec for SNPS PHY Aux will be always up. But from Xe3p LT PHY was introduced which powers down the PHY. Which means we need to make sure "Disable DC5/6" of AUX Programming sequence is honored. Add the AUX power domains to the DC_off power well on Xe3p_LPD+, so that DC5/6 stays disabled for as long as an AUX power domain is held. Bspec: 68851, 68967 Suggested-by: Imre Deak <imre.deak@intel.com> Co-developed-by: Ramanaidu Naladala <ramanaidu.naladala@intel.com> Signed-off-by: Ramanaidu Naladala <ramanaidu.naladala@intel.com> Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com> Reviewed-by: Arun R Murthy <arun.r.murthy@intel.com> Link: https://patch.msgid.link/20260921022016.1525322-1-suraj.kandpal@intel.com
2026-09-20drm/virtio: Recalculate ignore_damage_clips on every updateChristian Hergert
Plane state duplication preserves ignore_damage_clips. Once fbdev sets it for a dumb buffer, later updates using rendered resources continue to ignore damage because the flag is never cleared. Assign ignore_damage_clips on every atomic check so rendered resources can use supplied damage after an earlier dumb-buffer update. Signed-off-by: Christian Hergert <christian@sourceandstack.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Link: https://patch.msgid.link/20260903211914.1109100-3-lyude@redhat.com
2026-09-20drm/virtio: preserve damage clips for rendered resourcesChristian Hergert
virtio_gpu_plane_atomic_check() unconditionally ignores FB_DAMAGE_CLIPS when the framebuffer changes. This forces a full resource flush on every page flip when a compositor rotates through multiple framebuffers, even when userspace supplies accumulated per-buffer damage. The full update is required for dumb buffers because their contents are uploaded per buffer. Rendered resources are already coherent on the host, so replacing their damage with the full plane only discards useful information. Restrict ignore_damage_clips to dumb buffers. This allows damage-aware compositors to propagate partial updates through RESOURCE_FLUSH while preserving the existing full-upload behavior for dumb buffers. Signed-off-by: Christian Hergert <christian@sourceandstack.com> Reviewed-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Link: https://patch.msgid.link/20260903211914.1109100-2-lyude@redhat.com