Merge tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernelHEADmaster

Pull drm updates from Dave Airlie:
 "Highlights:

   - core: a lot of atomic refactoring in progress, panic got split into
     a core/helpers model

   - amdgpu: enables HDMI 2.1 FRL and other good things finally, UAlink
     over Ethernet support

   - xe: has a bunch of CRI support, ras error for bad vram, memory
     offlining support.

   - msm: enables a bunch more GPUs.

  Otherwise it's a the usual mountain of stuff all over the place.
  Details:

  rust:
   - I/O tree shared with driver-core
   - DMA tree shared with driver-core
   - allow aux registration data closures to return covariant sub-fields
   - Implement Send and Sync for MapleTree
   - add pci resource flags and IORESOURCE_MEM_64

  drm/rust:
   - add dma_fence abstraction
   - init DRM registrations and their data in place
   - drop unused flags argument to registration

  vgaarb:
   - rework API to pass a private ptr instead of pci device

  sound:
   - adapt to omapdrm changes

  gem:
   - add callback for handle count going to 0

  gpusvm:
   - share one HMM fault and keep single mappings inline

  pagemap:
   - Prevent CPU stalls during unbounded pagemap teardown

  dma-fence:
   - fix docs

  vga_switcheroo:
   - disconnect from fbcon
   - update fbcon from within fbdev emulation

  atomic:
   - move DRM from state reset callbacks to atomic_create_state
   - remove drm_simple_encoder_init

  panic:
   - split into core and helpers

  buddy:
   - improve dirty tracking

  clients:
   - improve vmap handling
   - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko

  display:
   - export HDMI SCDC status data via debugfs
   - rework SCDC for better HDMI 2.0 support
   - dp/mst: improve DPCD compliance

  edid:
   - parse AMD VSDB
   - parse ALLM/VRR capabilities
   - support detecting panel size

  log:
   - add drm_warn_ratelimited

  sched:
   - cleanup interface
   - add missing locking
   - fix run-queue cleanup
   - fix locking

  sysfb:
   - remove obsolete quirk for Lenovo D330
   - fix panel orientation for non-native display modes
   - drop drm_class_device_register

  colorop:
   - provide DRM_COLOR_OP_FIXED_MATRIX

  bridge:
   - analogix: Support eDP lane mapping
   - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84
   - Select DRM_PANEL_BRIDGE for various drivers that require it
   - add chrontel ch7218a support

  panel:
   - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
   - samsung-s6d16d0: Use mipi_dsi_*_multi() functions
   - support Ilitek ILI7836A OLED plus DT bindings
   - support Novatek NT36532 plus DT bindings
   - convert several drivers to managed cleanup
   - fix Kconfig selections
   - edp:
      - Add support for BOE NV140FHM-T0A
      - Support CSOT MNE007QB1-1
      - NV140WU2-M70
   - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization
   - samsung: Share test-key helpers
   - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings
   - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE
     DV215FHM-R01 plus DT bindings
   - Refactor struct drm_panel to contain struct drm_bridge plus fallout
     in various panel drivers
   - Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium
     RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO
     B140HAN04.0, AUO 0x0db3, panels.

  amdgpu:
   - use AMD VSDB for freesync
   - implement YUV-to-RGB with fixed-matrix colorop
   - enable FRL for HDMI
   - HDMI 2.1 freesync support
   - HDMI 2.1 ALLM support
   - HDMI 2.1 VRR support
   - UALoE (UALink over Ethernet) support
   - add syncobj_points to userq signal ioctl
   - drop unused kunit tests
   - NBIO/GC/MMHUB/SMU updates/fixes
   - GPU spatial partitioning updates
   - display kunit fixes
   - userq fixes
   - RGB quantization fixes
   - DC RMCM refactor
   - DP MST fixes
   - USB4 fixes
   - add new trace events
   - Rework display instance handling
   - stack frame size fixes for various compilers/configs
   - VCN 4/5 reset fixes
   - freesync updates
   - cursor refactor
   - Fix direct scanout alpha on some DRM_FORMATs
   - Expand Mac reserved memory workaround
   - Make runtime pm more fine grained

  amdkfd:
   - updates and fixes
   - GC 10 CU occupancy support

  radeon:
   - eDP fix for DCE3.2 iMacs

  xe:
   - add drm_ras netlink error event support
   - add memory page offlining support
   - introduce error threshold to drm_ras
   - fix stale GTT mappings on unmap
   - reject page faults for non-page fault mode scratch VM
   - enable CRI package and VRAM temperatures
   - introduce cold reset recovery
   - handle CRI+ power interval encoding
   - VF migration for multi-queue
   - handle exec queue teardown after hot unplug
   - alerts and controller enabling modifications
   - use IBCv3 on PTL
   - VRAM health check
   - report GT TDR and VM rebind faults using SIGID
   - add multi_queue_active_lrca debugfs
   - shrinker: Runtime PM reference for non-system memory
   - guc: Add simple KLV decoder helpers
   - debugfs: Expose per-engine idle status
   - Keep walking on SVM eviction failure
   - Nuke PTs only after unlinking contested VMAs
   - limit sg segment size to PAGE_SIZE on Xen PV
   - keep VF LMEM bar size low if no VFs
   - CPU binds and ULLS on migration queue
   - New PTL PCI ID
   - Enable PXP for NVL-S
   - Do not dma_fence_put zero fences in err_out path
   - Refresh TTM LRU on SVM prefetch
   - export device UID in sysfs

  i915:
   - rename GEN6_PCODE_DATA to match spec
   - fix incorrect RCU teardown order
   - fix potential UAF in command parsing
   - avoid WARN splat during RPS boosting race
   - use simpler min functions
   - Fixes to make i915 work well with PREEMPT_RT

  i915/display:
   - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path
   - Switch DG2 MPLL to DPLL framework
   - DP-HDMI PCON DSC fixes
   - limit invalid joiner combinations
   - CDCLK related fixes and refactor around PCODE integration
   - Gate UHBR SST SDP splitting on sink caps
   - add HDMI TMDS audio bandwidth check
   - vswing/preemph override
   - enable AS SDP Skip frames
   - Handle negative configuration index on DP link caps for robustness
   - Preparation for enabling SDR plane color pipeline
   - An eDP quirk for HP Pavilion Plus
   - Introduce PME (Power Management Event) support on display hotplug
   - Handle VSC SDP revision 7 in unpack

  msm:
   - CI:
      - Dropped sc7180 trogdor lazor from the CI
   - Core:
      - Fixed msm_ioremap for resources without a name
      - Changed msm.separate_gpu_kms to default to auto selection
   - GPU:
      - Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding
        limits on CX/GX rails
      - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85
        (Mahua)
      - Fix VBIF halt mask on a306, which was preventing runpm suspend
      - Enable THP support for GEM buffers
      - Add modparam to disable waiting on fences in shrinker
      - Drop use of drm_prime_sg_to_page_array()
      - a5xx: don't read the GPMU registers on GPUs without a GPMU
      - a2xx/a3xx/a5xx: hangcheck progress detection
      - a6xx: gmuwrapper runpm fix
      - Calculate reported GMEM size based on active slices
      - Split a6xx/a7xx/a8xx catalog
   - DP:
      - Picked up some preparation patches for the MST support
      - Fixed reported status of the link training
   - DPU:
      - Fixed CRTC bandwidth computation
      - Fixed DSC programming
      - Fixed encoder disablement path
   - DSI:
      - Fixed VM leak in error path
      - Indention fix
   - MDP5:
      - Added MSM8952 configuration
      - Dropped incorrect cursor pipe on MSM8976/56
   - HDMI:
      - Small fixes

  nouveau:
   - improve runtime PM on R570 GSP firmware
   - various fixes throughout the driver
   - dispnv50: support 2.147 GHz pixel clock in GB20x

  nova:
   - add initial uapi concept
   - add initial PRAMIN access support
   - add GpuMm centralized memory manager
   - add GPU VM and BAR1 support
   - add GPU interrupts and GSP events support
   - GSP messaging fixes

  tyr:
   - use bitfield!
   - zero unsupported and newly added GPU info fields
   - limit doorbell array to 17 entries

  exynos:
   - FIMD fixes
      - Fix clock leak on resume error path
      - Fix Sparse warnings by adding missing __iomem annotation
   - VIDI cleanup
      - Replace kmalloc() and copy_from_user() with memdup_user()

  amdxdna:
   - fix BO handling
   - Support AIE2 rev 9
   - Fix UAF access in scheduler fences
   - Update workqueue interface
   - expose busy time via fdinfo

  ast:
   - support 256-byte EDID

  hyperv_drm:
   - remove support for pre win10 hosts

  komeda:
   - fix GLB_CORE_ID usage

  omap:
   - report HDMI hotplug events to ASoC HDMI codec

  panthor:
   - provide gpu_cache_flush tracepoint
   - improve dma_fence signalling latency
   - improve locking
   - export scheduling information via debugfs
   - Validate user-space input against firmware limits

  qaic:
   - reject BOs that exceed maximum page count
   - add missing include statements

  verisilicon:
   - fix hardware cursor offsets

  vkms:
   - implement YUV-to-RGB with fixed-matrix colorop

  gma500:
   - avoid unsupported ARGB formats in primary plane

  hibmc:
   - handle vblank interrupts correctly

  ivpu:
   - add DRM_IVPU_CAP_CMDQ_SET_PRIORITY
   - support command-queue priority ioctl
   - Simplify NULL-pointer handling in cleanup code

  arcpgu:
   - replace simple-display pipeline with regular atomic helpers

  aspeed:
   - replace simple-display pipeline with regular atomic helpers

  gm12u320:
   - replace simple-display pipeline with regular atomic helpers

  imagination:
   - various improvement to firmware interaction
   - add job to pvr_job_submit_fw trace event

  mali-dp:
   - fix runtime PM leak

  mcde:
   - replace simple-display pipeline with regular atomic helpers

  p111:
   - replace simple-display pipeline with regular atomic helpers
   - drop unsupported alpha formats from primary plane

  rcar-du:
   - support Renesas R-Car V4H DSC
   - dsi: Support larger transfers with AXI memory
   - Support RZ/G3L SoC

  repaper:
   - replace simple-display pipeline with regular atomic helpers

  rockchip:
   - dsi: improve PHY timings

  ssd130x:
   - support Solomon SSD1351 OLED plus DT bindings
   - ssd133x: upgrade color format to RGB565
   - ssd132x: Set correct hardware window when clearing screen

  tve200:
   - replace simple-display pipeline with regular atomic helpers

  xen:
   - replace simple-display pipeline with regular atomic helpers

  v3d:
   - improve job handling under perfmon

  vc4:
   - reliably reset V3D
   - drop brcm,vc4-v3d compatible

  virtio:
   - fix damage handling
   - Support ARGB8888 for virtio primary planes.

  host1x:
   - Support partitioning

  imx:
   - Replace simple-display with regular atomic helpers

  mxsfb:
   - Support bus formats plus DT bindings

  tegra:
   - improve syncobj handling on submit

  panfrost:
   - add Mali-G68 support
   - improve GPU reset handling

  rockchip:
   - add HDMI 2.0 support to dw-hdmi-qp
   - improve HPD handling"

* tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel: (2324 commits)
  drm/adp: Switch to drm_atomic_helper_connector_create_state
  drm/malidp: Convert to atomic_create_state
  drm/vc4: Switch to drm_atomic_helper_connector_create_state
  drm/sysfb: Switch to drm_atomic_helper_connector_create_state
  drm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_state
  drm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_state
  drm/hyperv: Switch to drm_atomic_helper_connector_create_state
  drm/bridge: megachips: Switch to drm_atomic_helper_connector_create_state
  drm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_state
  drm/arm: komeda: Switch to drm_atomic_helper_connector_create_state
  drm/appletbdrm: Fix incorrect error message on encoder attach failure
  drm/sun4i: hdmi: Convert to drmm_connector_hdmi_init()
  drm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilities
  drm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilities
  drm/bridge: ite-it66121: Advertise HDMI 1.2 capabilities
  drm/bridge: ite-it6263: Advertise HDMI 1.3 capabilities
  drm/bridge: ite-it6263: Drop redundant .mode_valid hook
  drm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilities
  drm/bridge: adv7511: Advertise HDMI 1.2 capabilities
  drm/sched: Document entity->stopped is protected by entity->lock
  ...

9 files changed, 262 insertions, 7 deletions

diff --git a/drivers/accel/qaic/mhi_controller.c b/drivers/accel/qaic/mhi_controller.c
index 40e6d262ef21..c720b70b1e0f 100644
--- a/drivers/accel/qaic/mhi_controller.c
+++ b/drivers/accel/qaic/mhi_controller.c
@@ -23,6 +23,7 @@ MODULE_PARM_DESC(mhi_timeout_ms, "MHI controller timeout value");
 static const char *fw_image_paths[FAMILY_MAX] = {
 	[FAMILY_AIC100] = "qcom/aic100/sbl.bin",
 	[FAMILY_AIC200] = "qcom/aic200/sbl.bin",
+	[FAMILY_AIC200_VF] = NULL,
 };
 
 static const struct mhi_channel_config aic100_channels[] = {
@@ -691,6 +692,159 @@ static const struct mhi_channel_config aic200_channels[] = {
 	},
 };
 
+static const struct mhi_channel_config aic200vf_channels[] = {
+	{
+		.name = "QAIC_LOOPBACK",
+		.num = 0,
+		.num_elements = 32,
+		.local_elements = 0,
+		.event_ring = 0,
+		.dir = DMA_TO_DEVICE,
+		.ee_mask = MHI_CH_EE_AMSS,
+		.pollcfg = 0,
+		.doorbell = MHI_DB_BRST_DISABLE,
+		.lpm_notify = false,
+		.offload_channel = false,
+		.doorbell_mode_switch = false,
+		.wake_capable = false,
+	},
+	{
+		.name = "QAIC_LOOPBACK",
+		.num = 1,
+		.num_elements = 32,
+		.local_elements = 0,
+		.event_ring = 0,
+		.dir = DMA_FROM_DEVICE,
+		.ee_mask = MHI_CH_EE_AMSS,
+		.pollcfg = 0,
+		.doorbell = MHI_DB_BRST_DISABLE,
+		.lpm_notify = false,
+		.offload_channel = false,
+		.doorbell_mode_switch = false,
+		.wake_capable = false,
+	},
+	{
+		.name = "QAIC_SSR",
+		.num = 6,
+		.num_elements = 32,
+		.local_elements = 0,
+		.event_ring = 0,
+		.dir = DMA_TO_DEVICE,
+		.ee_mask = MHI_CH_EE_AMSS,
+		.pollcfg = 0,
+		.doorbell = MHI_DB_BRST_DISABLE,
+		.lpm_notify = false,
+		.offload_channel = false,
+		.doorbell_mode_switch = false,
+		.wake_capable = false,
+	},
+	{
+		.name = "QAIC_SSR",
+		.num = 7,
+		.num_elements = 32,
+		.local_elements = 0,
+		.event_ring = 0,
+		.dir = DMA_FROM_DEVICE,
+		.ee_mask = MHI_CH_EE_AMSS,
+		.pollcfg = 0,
+		.doorbell = MHI_DB_BRST_DISABLE,
+		.lpm_notify = false,
+		.offload_channel = false,
+		.doorbell_mode_switch = false,
+		.wake_capable = false,
+	},
+	{
+		.name = "QAIC_CONTROL",
+		.num = 10,
+		.num_elements = 128,
+		.local_elements = 0,
+		.event_ring = 0,
+		.dir = DMA_TO_DEVICE,
+		.ee_mask = MHI_CH_EE_AMSS,
+		.pollcfg = 0,
+		.doorbell = MHI_DB_BRST_DISABLE,
+		.lpm_notify = false,
+		.offload_channel = false,
+		.doorbell_mode_switch = false,
+		.wake_capable = false,
+	},
+	{
+		.name = "QAIC_CONTROL",
+		.num = 11,
+		.num_elements = 128,
+		.local_elements = 0,
+		.event_ring = 0,
+		.dir = DMA_FROM_DEVICE,
+		.ee_mask = MHI_CH_EE_AMSS,
+		.pollcfg = 0,
+		.doorbell = MHI_DB_BRST_DISABLE,
+		.lpm_notify = false,
+		.offload_channel = false,
+		.doorbell_mode_switch = false,
+		.wake_capable = false,
+	},
+	{
+		.name = "QAIC_TELEMETRY",
+		.num = 16,
+		.num_elements = 32,
+		.local_elements = 0,
+		.event_ring = 0,
+		.dir = DMA_TO_DEVICE,
+		.ee_mask = MHI_CH_EE_AMSS,
+		.pollcfg = 0,
+		.doorbell = MHI_DB_BRST_DISABLE,
+		.lpm_notify = false,
+		.offload_channel = false,
+		.doorbell_mode_switch = false,
+		.wake_capable = false,
+	},
+	{
+		.name = "QAIC_TELEMETRY",
+		.num = 17,
+		.num_elements = 32,
+		.local_elements = 0,
+		.event_ring = 0,
+		.dir = DMA_FROM_DEVICE,
+		.ee_mask = MHI_CH_EE_AMSS,
+		.pollcfg = 0,
+		.doorbell = MHI_DB_BRST_DISABLE,
+		.lpm_notify = false,
+		.offload_channel = false,
+		.doorbell_mode_switch = false,
+		.wake_capable = false,
+	},
+	{
+		.name = "IPCR",
+		.num = 24,
+		.num_elements = 32,
+		.local_elements = 0,
+		.event_ring = 0,
+		.dir = DMA_TO_DEVICE,
+		.ee_mask = MHI_CH_EE_AMSS,
+		.pollcfg = 0,
+		.doorbell = MHI_DB_BRST_DISABLE,
+		.lpm_notify = false,
+		.offload_channel = false,
+		.doorbell_mode_switch = false,
+		.wake_capable = false,
+	},
+	{
+		.name = "IPCR",
+		.num = 25,
+		.num_elements = 32,
+		.local_elements = 0,
+		.event_ring = 0,
+		.dir = DMA_FROM_DEVICE,
+		.ee_mask = MHI_CH_EE_AMSS,
+		.pollcfg = 0,
+		.doorbell = MHI_DB_BRST_DISABLE,
+		.lpm_notify = false,
+		.offload_channel = false,
+		.doorbell_mode_switch = false,
+		.wake_capable = false,
+	},
+};
+
 static struct mhi_event_config aic100_events[] = {
 	{
 		.num_elements = 32,
@@ -721,6 +875,21 @@ static struct mhi_event_config aic200_events[] = {
 	},
 };
 
+static struct mhi_event_config aic200vf_events[] = {
+	{
+		.num_elements = 32,
+		.irq_moderation_ms = 0,
+		.irq = 0,
+		.channel = U32_MAX,
+		.priority = 1,
+		.mode = MHI_DB_BRST_DISABLE,
+		.data_type = MHI_ER_CTRL,
+		.hardware_event = false,
+		.client_managed = false,
+		.offload_channel = false,
+	},
+};
+
 static struct mhi_controller_config mhi_cntrl_configs[] = {
 	[FAMILY_AIC100] = {
 		.max_channels = 128,
@@ -744,6 +913,17 @@ static struct mhi_controller_config mhi_cntrl_configs[] = {
 		.use_bounce_buf = false,
 		.m2_no_db = false,
 	},
+	[FAMILY_AIC200_VF] = {
+		.max_channels = 128,
+		.timeout_ms = 0, /* controlled by mhi_timeout */
+		.buf_len = 0,
+		.num_channels = ARRAY_SIZE(aic200vf_channels),
+		.ch_cfg = aic200vf_channels,
+		.num_events = ARRAY_SIZE(aic200vf_events),
+		.event_cfg = aic200vf_events,
+		.use_bounce_buf = false,
+		.m2_no_db = false,
+	},
 };
 
 static int mhi_read_reg(struct mhi_controller *mhi_cntrl, void __iomem *addr, u32 *out)
@@ -864,11 +1044,19 @@ struct mhi_controller *qaic_mhi_register_controller(struct pci_dev *pci_dev, voi
 
 	mhi_cntrl->fw_image = fw_image_paths[family];
 
-	if (family == FAMILY_AIC200) {
+	switch (family) {
+	case FAMILY_AIC200:
 		mhi_cntrl->name = "AIC200";
 		mhi_cntrl->seg_len = SZ_512K;
-	} else {
+		break;
+	case FAMILY_AIC200_VF:
+		mhi_cntrl->name = "AIC200_VF";
+		break;
+	case FAMILY_AIC100:
 		mhi_cntrl->name = "AIC100";
+		break;
+	default:
+		mhi_cntrl->name = NULL;
 	}
 
 	/* use latest configured timeout */
diff --git a/drivers/accel/qaic/qaic.h b/drivers/accel/qaic/qaic.h
index 02ca99000e2a..889fa51da7da 100644
--- a/drivers/accel/qaic/qaic.h
+++ b/drivers/accel/qaic/qaic.h
@@ -35,6 +35,7 @@
 enum aic_families {
 	FAMILY_AIC100,
 	FAMILY_AIC200,
+	FAMILY_AIC200_VF,
 	FAMILY_MAX,
 };
 
diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c
index ef0351b6dc9b..ee35e13091b3 100644
--- a/drivers/accel/qaic/qaic_data.c
+++ b/drivers/accel/qaic/qaic_data.c
@@ -15,6 +15,7 @@
 #include <linux/math64.h>
 #include <linux/mm.h>
 #include <linux/moduleparam.h>
+#include <linux/overflow.h>
 #include <linux/scatterlist.h>
 #include <linux/spinlock.h>
 #include <linux/srcu.h>
@@ -455,7 +456,12 @@ static int create_sgt(struct qaic_device *qdev, struct sg_table **sgt_out, u64 s
 	int order;
 
 	if (size) {
-		nr_pages = DIV_ROUND_UP(size, PAGE_SIZE);
+		u64 nr_pages_u64 = DIV_ROUND_UP_ULL(size, PAGE_SIZE);
+
+		if (overflows_type(nr_pages_u64, int))
+			return -E2BIG;
+
+		nr_pages = nr_pages_u64;
 		/*
 		 * calculate how much extra we are going to allocate, to remove
 		 * later
@@ -1834,15 +1840,16 @@ int qaic_perf_stats_bo_ioctl(struct drm_device *dev, void *data, struct drm_file
 			goto free_ent;
 		}
 		bo = to_qaic_bo(obj);
+		ret = mutex_lock_interruptible(&bo->lock);
+		if (ret)
+			goto put_obj;
 		if (!bo->sliced) {
-			drm_gem_object_put(obj);
 			ret = -EINVAL;
-			goto free_ent;
+			goto unlock_bo;
 		}
 		if (bo->dbc->id != args->hdr.dbc_id) {
-			drm_gem_object_put(obj);
 			ret = -EINVAL;
-			goto free_ent;
+			goto unlock_bo;
 		}
 		/*
 		 * perf stats ioctl is called before wait ioctl is complete then
@@ -1858,7 +1865,12 @@ int qaic_perf_stats_bo_ioctl(struct drm_device *dev, void *data, struct drm_file
 						    bo->perf_stats.req_received_ts), 1000);
 		ent[i].queue_level_before = bo->perf_stats.queue_level_before;
 		ent[i].num_queue_element = bo->total_slice_nents;
+unlock_bo:
+		mutex_unlock(&bo->lock);
+put_obj:
 		drm_gem_object_put(obj);
+		if (ret)
+			goto free_ent;
 	}
 
 	if (copy_to_user(u64_to_user_ptr(args->data), ent, args->hdr.count * sizeof(*ent)))
diff --git a/drivers/accel/qaic/qaic_debugfs.c b/drivers/accel/qaic/qaic_debugfs.c
index 95c78e12dd61..909a4d774d90 100644
--- a/drivers/accel/qaic/qaic_debugfs.c
+++ b/drivers/accel/qaic/qaic_debugfs.c
@@ -5,6 +5,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/device.h>
+#include <linux/device-id/mhi.h>
 #include <linux/fs.h>
 #include <linux/list.h>
 #include <linux/mhi.h>
diff --git a/drivers/accel/qaic/qaic_drv.c b/drivers/accel/qaic/qaic_drv.c
index 0acf6cdd44f8..9e1e184efe0d 100644
--- a/drivers/accel/qaic/qaic_drv.c
+++ b/drivers/accel/qaic/qaic_drv.c
@@ -4,6 +4,7 @@
 /* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */
 
 #include <linux/delay.h>
+#include <linux/device-id/mhi.h>
 #include <linux/dma-mapping.h>
 #include <linux/idr.h>
 #include <linux/interrupt.h>
@@ -39,6 +40,7 @@ MODULE_IMPORT_NS("DMA_BUF");
 #define PCI_DEVICE_ID_QCOM_AIC080	0xa080
 #define PCI_DEVICE_ID_QCOM_AIC100	0xa100
 #define PCI_DEVICE_ID_QCOM_AIC200	0xa110
+#define PCI_DEVICE_ID_QCOM_AIC200VF	0xa111
 #define QAIC_NAME			"qaic"
 #define QAIC_DESC			"Qualcomm Cloud AI Accelerators"
 #define CNTL_MAJOR			5
@@ -77,6 +79,13 @@ static const struct qaic_device_config aic200_config = {
 	.dbc_bar_idx = 2,
 };
 
+static const struct qaic_device_config aic200vf_config = {
+	.family = FAMILY_AIC200_VF,
+	.bar_mask = BIT(0) | BIT(1) | BIT(2) | BIT(4),
+	.mhi_bar_idx = 1,
+	.dbc_bar_idx = 2,
+};
+
 bool datapath_polling;
 module_param(datapath_polling, bool, 0400);
 MODULE_PARM_DESC(datapath_polling, "Operate the datapath in polling mode");
@@ -609,6 +618,8 @@ static void qaic_pci_remove(struct pci_dev *pdev)
 {
 	struct qaic_device *qdev = pci_get_drvdata(pdev);
 
+	pci_disable_sriov(pdev);
+
 	if (!qdev)
 		return;
 
@@ -665,6 +676,7 @@ static const struct pci_device_id qaic_ids[] = {
 	{ PCI_DEVICE_DATA(QCOM, AIC080, (kernel_ulong_t)&aic080_config), },
 	{ PCI_DEVICE_DATA(QCOM, AIC100, (kernel_ulong_t)&aic100_config), },
 	{ PCI_DEVICE_DATA(QCOM, AIC200, (kernel_ulong_t)&aic200_config), },
+	{ PCI_DEVICE_DATA(QCOM, AIC200VF, (kernel_ulong_t)&aic200vf_config), },
 	{ }
 };
 MODULE_DEVICE_TABLE(pci, qaic_ids);
@@ -761,6 +773,41 @@ static const struct dev_pm_ops qaic_pm_ops = {
 	SYSTEM_SLEEP_PM_OPS(qaic_pm_suspend, qaic_pm_resume)
 };
 
+static int qaic_pci_sriov_configure(struct pci_dev *pdev, int num_vfs)
+{
+	struct qaic_device *qdev = pci_get_drvdata(pdev);
+	int rcu_id;
+	int ret;
+
+	if (num_vfs == 0) {
+		pci_disable_sriov(pdev);
+		return 0;
+	}
+
+	rcu_id = srcu_read_lock(&qdev->dev_lock);
+	/* Qaic device must be online to process VF bringup */
+	if (qdev->dev_state == QAIC_OFFLINE) {
+		ret = -ENODEV;
+		goto unlock_dev_srcu;
+	}
+	if (qdev->dev_state == QAIC_BOOT) {
+		ret = -EBUSY;
+		goto unlock_dev_srcu;
+	}
+
+	ret = pci_enable_sriov(pdev, num_vfs);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to enable SR-IOV: %d (requested %d VFs, max %d)\n",
+			ret, num_vfs, pci_sriov_get_totalvfs(pdev));
+		goto unlock_dev_srcu;
+	}
+
+	dev_dbg(&pdev->dev, "Successfully enabled %d VFs\n", num_vfs);
+unlock_dev_srcu:
+	srcu_read_unlock(&qdev->dev_lock, rcu_id);
+	return ret ?: num_vfs;
+}
+
 static struct pci_driver qaic_pci_driver = {
 	.name = QAIC_NAME,
 	.id_table = qaic_ids,
@@ -768,6 +815,7 @@ static struct pci_driver qaic_pci_driver = {
 	.remove = qaic_pci_remove,
 	.shutdown = qaic_pci_shutdown,
 	.err_handler = &qaic_pci_err_handler,
+	.sriov_configure = qaic_pci_sriov_configure,
 	.driver = {
 		.pm = pm_sleep_ptr(&qaic_pm_ops),
 	},
diff --git a/drivers/accel/qaic/qaic_ras.c b/drivers/accel/qaic/qaic_ras.c
index e0205c2cda3d..236e520f708f 100644
--- a/drivers/accel/qaic/qaic_ras.c
+++ b/drivers/accel/qaic/qaic_ras.c
@@ -5,6 +5,7 @@
 
 #include <asm/byteorder.h>
 #include <linux/device.h>
+#include <linux/device-id/mhi.h>
 #include <linux/kernel.h>
 #include <linux/mhi.h>
 
diff --git a/drivers/accel/qaic/qaic_ssr.c b/drivers/accel/qaic/qaic_ssr.c
index a98928654959..418f14936f9a 100644
--- a/drivers/accel/qaic/qaic_ssr.c
+++ b/drivers/accel/qaic/qaic_ssr.c
@@ -8,6 +8,7 @@
 #include <drm/drm_managed.h>
 #include <linux/devcoredump.h>
 #include <linux/device.h>
+#include <linux/device-id/mhi.h>
 #include <linux/kernel.h>
 #include <linux/mhi.h>
 #include <linux/workqueue.h>
diff --git a/drivers/accel/qaic/qaic_timesync.c b/drivers/accel/qaic/qaic_timesync.c
index 45e5f0728ebe..b5162677ccc4 100644
--- a/drivers/accel/qaic/qaic_timesync.c
+++ b/drivers/accel/qaic/qaic_timesync.c
@@ -2,6 +2,7 @@
 
 /* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */
 
+#include <linux/device-id/mhi.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/math64.h>
diff --git a/drivers/accel/qaic/sahara.c b/drivers/accel/qaic/sahara.c
index c7c0b3eb4b65..e951181e424f 100644
--- a/drivers/accel/qaic/sahara.c
+++ b/drivers/accel/qaic/sahara.c
@@ -3,6 +3,7 @@
 /* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */
 
 #include <linux/devcoredump.h>
+#include <linux/device-id/mhi.h>
 #include <linux/firmware.h>
 #include <linux/limits.h>
 #include <linux/mhi.h>
@@ -880,6 +881,7 @@ static void sahara_mhi_remove(struct mhi_device *mhi_dev)
 
 	cancel_work_sync(&context->fw_work);
 	cancel_work_sync(&context->dump_work);
+	cancel_work_sync(&context->read_data_work);
 	vfree(context->mem_dump);
 	sahara_release_image(context);
 	mhi_unprepare_from_transfer(mhi_dev);