Commit graph

126,832 commits

Author SHA1 Message Date
Linus Torvalds
a4ff2be345 This update includes the following changes:
API:
 
 - Add af_alg_restrict sysctl and white list.
 - Fix potential suspend/resume races in hwrng.
 
 Algorithms:
 
 - Optimize vli additive operations using compiler builtins in ecc.
 
 Drivers:
 
 - Remove unsafe/deprecated algorithms from qce.
 - Mark qce as BROKEN.
 - Add runtime PM and interconnect bandwidth scaling support to qce.
 - Remove crypto_rng from qcom, sun8i and caam.
 - Fix SG list issues in iaa.
 - Fix SEV init path bugs in ccp.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmqEC3gACgkQxycdCkmx
 i6fOCw/9EzjhD0xotKv0Kylk/ukG+UYhh2j1zwFbMUuRl0GQCklSfM19h0DQ53vS
 FgJqf+69Q9sfn2HxihxQJGkW+NmiqwlHG9veu2PRBXRnMDjFQ8LDHAVEShvL4Jzv
 PW9daF3KsOjlcFuOVHum9SdQ2tdsoClEtBv8W9ndOxxGxGj3827etOWSTTp4DprP
 y2bpcE3R+CjmOgATmAQfOiKdLtghv8SspSRUmwVmj8lVijkjTiH9UELwQ4Tp407q
 vZU027gBHaWKb4VBLPX3NUg0UaJFsieKGrty2EZqX0nXF4f2jaPYB1iP9Y+92qcP
 WfvidNpVeLpRlJpf5QH1ZqiH7qf9I1YdOXcNe8IL+3b+9SYiyqDY3vuCeBE05dOJ
 Oty9m8pIV7IwZmhUIhZ0PdIl58urzxYPvCdD0IdAsA0sdNQEBcbTnuVuQjxt4AG0
 GYPqiZdtRs5r3MkdRpymV49TBJ+vMY3Wo1lnCcnpCgxugTAx7tkFtMNBJSHF7DbC
 N1vwb2EYaTyzmH5Vr3dHLWeONskyIRa0WNhnszmIBie3M0AYF2sOkNw3iXVPQxXv
 a5XbXh/kAx0nc417dp1B8lZclHH2bWvEKHYalpT33GX4qsGuI4bH4uKaOrL0pXp1
 WyNzGiCiWJBp2o9wNj/TxKCp7oGeD4ZRv0HeRrEHezSInoTrt9w=
 =f9oK
 -----END PGP SIGNATURE-----

Merge tag 'v7.3-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto update from Herbert Xu:
 "API:
   - Add af_alg_restrict sysctl and white list
   - Fix potential suspend/resume races in hwrng

  Algorithms:
   - Optimize vli additive operations using compiler builtins in ecc

  Drivers:
   - Remove unsafe/deprecated algorithms from qce
   - Mark qce as BROKEN
   - Add runtime PM and interconnect bandwidth scaling support to qce
   - Remove crypto_rng from qcom, sun8i and caam
   - Fix SG list issues in iaa
   - Fix SEV init path bugs in ccp"

* tag 'v7.3-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (122 commits)
  crypto: lskcipher - propagate errors from unaligned crypt
  crypto: keembay - use crypto_memneq() to compare CCM AEAD tags
  crypto: keembay - use crypto_memneq() to compare GCM AEAD tags
  crypto: sa2ul - use crypto_memneq() to compare AEAD tag
  hwrng: drivers - use named initializers for acpi_device_id
  crypto: qce - fix CCM AAD buffer underallocation
  crypto: iaa - unmap dst before software fallback on decompress
  crypto: iaa - use bounce buffer for multi-sg decompress input
  crypto: iaa - avoid counting fallback decompression bytes
  crypto: iaa - fall back to software for multi-entry scatterlists
  hwrng: core - Stop/start hwrng_fillfn() kthread before/after suspend-resume
  crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
  crypto: eip93 - use struct_size() and flexible array for ring allocation
  crypto: krb5 - use kfree_sensitive() for derived key buffers
  crypto: af_alg - Stop after finding name in allowlist
  crypto: af_alg - Replace 'bool privileged' with flags
  crypto: af_alg - Make cbc(paes) privileged-only
  hwrng: imx-rngc - Disable clock on registration failure
  crypto: qat - remove dead ADF_HEX code
  crypto: qce - simplify qce_handle_request
  ...
2026-08-19 17:25:42 -07:00
Linus Torvalds
59e6295fac Driver core changes for 7.3-rc1
- container_of:
 
   - Apply typeof_member(), remove the local __mptr variable to eliminate
     variable shadowing warnings on nested container_of() calls, and remove
     unnecessary parentheses.
 
 - core:
 
   - Add driver name to probe debug print for initcall_debug.
 
   - Avoid repeatedly printing the same 'Fixed dependency cycle' log.
 
   - Unwind device_add() on attribute creation failure in
     attribute_container_add_class_device().
 
   - Remove statistics group if encryption group creation fails in
     transport_add_class_device().
 
 - debugfs:
 
   - Fix lockdown check for mmap_prepare().
 
   - Warn if file creation failed due to uninitialized debugfs.
 
 - device property:
 
   - Implement fw_devlink support for software nodes by adding
     software_node_add_links(), which creates fwnode links from DEV_PROP_REF
     properties to enable automatic probe ordering. Add kunit-managed fwnode
     helpers and test coverage.
 
   - Fix infinite loop in fwnode_for_each_child_node() when the secondary fwnode
     has more than one child. Add test cases.
 
   - Fix out-of-bounds access in software_node_get_reference_args() when called
     with index -1 (UINT_MAX).
 
   - Refactor to use RAII approach with __free().
 
   - Add Bartosz Golaszewski as software node reviewer.
 
 - firmware loader:
 
   - Fix race where a sysfs fallback request can complete before being queued as
     pending, leading to a use-after-free on the next fallback request.
 
   - Reject 0-size built-in firmware and fail the build on empty firmware files
     in CONFIG_EXTRA_FIRMWARE.
 
 - kobject:
 
   - Provide __KOBJ_ATTR() and __KOBJ_ATTR_RO/WO() initialization macros and
     allow the constification of kobject attributes, enabling them to reside in
     read-only memory.
 
 - platform:
 
   - Provide platform_device_set_of_node(), platform_device_set_fwnode(), and
     platform_device_set_of_node_from_dev() helpers that encapsulate firmware
     node reference counting for dynamically allocated platform devices. Convert
     all in-tree users that manually assigned dev.of_node or dev.fwnode, fixing a
     pre-existing refcount bug in powermac.  Switch to counting references of all
     firmware node types, not only OF nodes.
 
   - Unify the release path for dynamically allocated platform devices by
     removing platform_device_release_full(). Amend the fwnode setter API
     contract to warn if a primary software node is overwritten. Add KUnit tests
     for correct software node removal on device unregistration.
 
 - Rust:
 
   - Auxiliary:
 
     - Add registration_data_with() closure-based API for invariant ForLt types.
 
   - Debugfs:
 
     - Migrate BinaryWriter and BinaryReaderMut trait requirements from
       kernel::transmute traits to zerocopy traits.
 
   - Device:
 
     - Add BoundInternal device context and InternalBoundContext trait for bus
       abstractions that need internal access to a bound device.
 
     - Make the lifetime on Core and CoreInternal invariant to prevent coercion
       to shorter lifetimes.
 
   - Devres:
 
     - Fix race between concurrent revokers where the losing revoker could return
       before the winning revoker finished dropping the inner data, causing
       use-after-free.
 
     - Ensure revocation is complete before the device finishes unbinding by
       making the synchronization bidirectional.
 
     - Add DevresLt<F: ForLt>, a wrapper around Devres that shortens 'static back
       to the caller's borrow scope. Implement ForLt and CovariantForLt for Bar,
       IoMem, and ExclusiveIoMem.
 
   - Driver:
 
     - Switch from index-based to pointer-based device ID info lookup, storing
       static references in driver_data. Centralize device ID handling in
       device_id.rs, removing the open-coded ACPI/OF matching logic and duplicate
       ID table from driver.rs.
 
   - I/O:
 
     - Make I/O regions typed (with a dynamically-sized Region type for the
       existing untyped case), create view types representing subregions of a
       mapped I/O region, and add io_project!() for safely creating subviews.
 
     - Split Io into a base trait (IoBase) and an extension trait (Io) with a
       blanket implementation, preventing implementers from overriding provided
       methods that unsafe code relies on.
 
     - Add a SysMem backend for shared system memory with volatile access, and
       make Coherent implement Io via an I/O view type.  Add IoSysMap as sum type
       of Mmio and SysMem. Add copying methods (memcpy_{from,to}io()) and
       read_val()/write_val() for typed access.
 
     - Replace dma_read!()/dma_write!() with io_read!()/io_write!() for
       primitives and copying methods for aggregates; drop the old macros.
       Convert nova-core to use I/O projection.
 
     - Fix internal shortcut rule dispatch in the register!() macro, remove
       unused rule arguments, and use path fragments for alias destinations.
 
   - IRQ:
 
     - Make irq::Registration compatible with lifetime-bound drivers by
       removing the 'static bound on Handler/ThreadedHandler and
       replacing Devres<RegistrationInner> with direct
       request_irq()/free_irq() calls.  Handlers can now directly own
       lifetime-bound device resources.
 
   - PCI:
 
     - Convert IrqVectorRegistration to a lifetime-annotated owning type,
       giving drivers explicit control over the allocation lifetime.
       IrqVector embeds a resolved IrqRequest, making the conversion
       infallible. Remove the redundant
       request_irq()/request_threaded_irq() wrappers from pci::Device.
 
     - Add pci_irq_type() C helper and expose it via irq_type() on
       IrqVectorRegistration and IrqVector, returning PCI_IRQ_MSIX, PCI_IRQ_MSI,
       or PCI_IRQ_INTX.
 
     - Mark pci::Device refcount methods inline.
 
   - Serdev:
 
     - Add Rust abstractions for the serial device bus, including serdev::Driver
       trait, serdev::Device wrapping struct serdev_device, and serdev::Adapter
       implementing RegistrationOps.  Includes a sample driver. Markus Probst
       takes over as serdev maintainer for both C and Rust code.
 
   - Misc:
 
     - Split ForLt into a base trait (providing the Of<'a> GAT) and an unsafe
       CovariantForLt subtrait guaranteeing covariance, enabling invariant types
       (e.g. those containing Mutex<&'bound T>) to participate in the ForLt
       abstraction.
 
     - Fix Coherent read past EOF returning -ERANGE instead of zero.
 
     - Fix firmware example UB by avoiding null-pointer ARef.
 
 - misc:
 
   - Avoid iattr allocation in kernfs listxattr by using kernfs_iattrs_noalloc().
   - Unregister SoC bus on early device registration failure.
   - Remove unused DMA_FENCE_TRACE Kconfig symbol.
   - Fix /sys/module path in comment.
   - Refactor ISA bus init to remove nested blocks.
   - Remove redundant nodemask clears in numa_init().
   - Add kernel-doc for fwnode_operations and sys_soc.h, mark internal property
     data as private for kernel-doc, and add property.h/fwnode.h to driver-api
     infrastructure docs.
   - Add MAINTAINERS entry for sys_soc.h.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCaoSPugAKCRBFlHeO1qrK
 LlBrAP958EaYZVyfAsqq0EyHv86ahXKWoDDvkwbRUZA5CfV9tAD/bMWVtPLRYaaq
 eNEZT7p5w3Haezh61H3c5zpuwFNMTA0=
 =VRIa
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core updates from Danilo Krummrich:
 "container_of:

   - Apply typeof_member(), remove the local __mptr variable to
     eliminate variable shadowing warnings on nested container_of()
     calls, and remove unnecessary parentheses

  core:

   - Add driver name to probe debug print for initcall_debug

   - Avoid repeatedly printing the same 'Fixed dependency cycle' log

   - Unwind device_add() on attribute creation failure in
     attribute_container_add_class_device()

   - Remove statistics group if encryption group creation fails in
     transport_add_class_device()

  debugfs:

   - Fix lockdown check for mmap_prepare()

   - Warn if file creation failed due to uninitialized debugfs

  device property:

   - Implement fw_devlink support for software nodes by adding
     software_node_add_links(), which creates fwnode links from
     DEV_PROP_REF properties to enable automatic probe ordering. Add
     kunit-managed fwnode helpers and test coverage

   - Fix infinite loop in fwnode_for_each_child_node() when the
     secondary fwnode has more than one child. Add test cases

   - Fix out-of-bounds access in software_node_get_reference_args() when
     called with index -1 (UINT_MAX)

   - Refactor to use RAII approach with __free()

   - Add Bartosz Golaszewski as software node reviewer

  firmware loader:

   - Fix race where a sysfs fallback request can complete before being
     queued as pending, leading to a use-after-free on the next fallback
     request

   - Reject 0-size built-in firmware and fail the build on empty
     firmware files in CONFIG_EXTRA_FIRMWARE

  kobject:

   - Provide __KOBJ_ATTR() and __KOBJ_ATTR_RO/WO() initialization macros
     and allow the constification of kobject attributes, enabling them
     to reside in read-only memory

  platform:

   - Provide platform_device_set_of_node(), platform_device_set_fwnode(),
     and platform_device_set_of_node_from_dev() helpers that encapsulate
     firmware node reference counting for dynamically allocated platform
     devices

     Convert all in-tree users that manually assigned dev.of_node or
     dev.fwnode, fixing a pre-existing refcount bug in powermac. Switch
     to counting references of all firmware node types, not only OF
     nodes

   - Unify the release path for dynamically allocated platform devices
     by removing platform_device_release_full(). Amend the fwnode setter
     API contract to warn if a primary software node is overwritten. Add
     KUnit tests for correct software node removal on device
     unregistration

  Rust:

   - Auxiliary:
       - Add registration_data_with() closure-based API for invariant
         ForLt types

   - Debugfs:
       - Migrate BinaryWriter and BinaryReaderMut trait requirements
         from kernel::transmute traits to zerocopy traits

   - Device:
       - Add BoundInternal device context and InternalBoundContext trait
         for bus abstractions that need internal access to a bound
         device.
       - Make the lifetime on Core and CoreInternal invariant to prevent
         coercion to shorter lifetimes

   - Devres:
       - Fix race between concurrent revokers where the losing revoker
         could return before the winning revoker finished dropping the
         inner data, causing use-after-free.
       - Ensure revocation is complete before the device finishes
         unbinding by making the synchronization bidirectional.
       - Add DevresLt<F: ForLt>, a wrapper around Devres that shortens
         'static back to the caller's borrow scope. Implement ForLt and
         CovariantForLt for Bar, IoMem, and ExclusiveIoMem

   - Driver:
       - Switch from index-based to pointer-based device ID info lookup,
         storing static references in driver_data. Centralize device ID
         handling in device_id.rs, removing the open-coded ACPI/OF
         matching logic and duplicate ID table from driver.rs

   - I/O:
       - Make I/O regions typed (with a dynamically-sized Region type
         for the existing untyped case), create view types representing
         subregions of a mapped I/O region, and add io_project!() for
         safely creating subviews.
       - Split Io into a base trait (IoBase) and an extension trait (Io)
         with a blanket implementation, preventing implementers from
         overriding provided methods that unsafe code relies on.
       - Add a SysMem backend for shared system memory with volatile
         access, and make Coherent implement Io via an I/O view type.
         Add IoSysMap as sum type of Mmio and SysMem. Add copying
         methods (memcpy_{from,to}io()) and read_val()/write_val() for
         typed access.
       - Replace dma_read!()/dma_write!() with io_read!()/io_write!()
         for primitives and copying methods for aggregates; drop the old
         macros. Convert nova-core to use I/O projection.
       - Fix internal shortcut rule dispatch in the register!() macro,
         remove unused rule arguments, and use path fragments for alias
         destinations

   - IRQ:
       - Make irq::Registration compatible with lifetime-bound drivers
         by removing the 'static bound on Handler/ThreadedHandler and
         replacing Devres<RegistrationInner> with direct
         request_irq()/free_irq() calls. Handlers can now directly own
         lifetime-bound device resources

   - PCI:
       - Convert IrqVectorRegistration to a lifetime-annotated owning
         type, giving drivers explicit control over the allocation
         lifetime. IrqVector embeds a resolved IrqRequest, making the
         conversion infallible. Remove the redundant
         request_irq()/request_threaded_irq() wrappers from pci::Device.
       - Add pci_irq_type() C helper and expose it via irq_type() on
         IrqVectorRegistration and IrqVector, returning PCI_IRQ_MSIX,
         PCI_IRQ_MSI, or PCI_IRQ_INTX.
       - Mark pci::Device refcount methods inline

   - Serdev:
       - Add Rust abstractions for the serial device bus, including
         serdev::Driver trait, serdev::Device wrapping struct
         serdev_device, and serdev::Adapter implementing
         RegistrationOps. Includes a sample driver. Markus Probst takes
         over as serdev maintainer for both C and Rust code

   - Misc:
       - Split ForLt into a base trait (providing the Of<'a> GAT) and an
         unsafe CovariantForLt subtrait guaranteeing covariance,
         enabling invariant types (e.g. those containing Mutex<&'bound T>)
         to participate in the ForLt abstraction.
       - Fix Coherent read past EOF returning -ERANGE instead of zero.
       - Fix firmware example UB by avoiding null-pointer ARef

  misc:
   - Avoid iattr allocation in kernfs listxattr by using
     kernfs_iattrs_noalloc().
   - Unregister SoC bus on early device registration failure.
   - Remove unused DMA_FENCE_TRACE Kconfig symbol.
   - Fix /sys/module path in comment.
   - Refactor ISA bus init to remove nested blocks.
   - Remove redundant nodemask clears in numa_init().
   - Add kernel-doc for fwnode_operations and sys_soc.h, mark
     internal property data as private for kernel-doc, and add
     property.h/fwnode.h to driver-api infrastructure docs.
   - Add MAINTAINERS entry for sys_soc.h"

* tag 'driver-core-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (129 commits)
  rust: pci: expose the allocated interrupt type
  PCI: Add pci_irq_type() to query the allocated interrupt type
  rust: pci: remove request_irq() and request_threaded_irq() from Device
  rust: pci: resolve IRQ in index() and embed IrqRequest in IrqVector
  rust: pci: convert IrqVectorRegistration to a lifetime-managed owning type
  kernfs: avoid iattr allocation in listxattr
  rust: serdev: use ThisModule::as_ptr() instead of field access
  ACPI/IORT: use platform_device_set_fwnode()
  ACPI/APMT: use platform_device_set_fwnode()
  firmware_loader: do not queue completed sysfs fallback requests
  rust: pci: Mark Device refcount methods inline
  rust: irq: make Registration compatible with lifetime-bound drivers
  rust: net/phy: remove expansion from doc
  rust: dma: return zero for Coherent reads past EOF
  rust: io: register: use path fragment for alias destination
  rust: io: register: remove unused rule arguments
  rust: io: register: dispatch shortcut rules internally
  MAINTAINERS: add sys_soc.h to DRIVER CORE
  rust: debugfs: remove unsafe blocks from traits impl for Vec
  rust: debugfs: migrate debugfs traits requirements to zerocopy
  ...
2026-08-19 10:42:18 -07:00
Linus Torvalds
368cf60c36 soc: drivers for 7.3
The SoC driver changes once more consist of many small fixes and
 cleanups, that are to a large part the result of automated testing. On
 platform specific drivers, this includes SoC specific code for xilinx,
 freescale/nxp, qualcomm, TI, aspeed, omap, tegra, samsung, rockchip,
 renesas, ixp4xx. In firmware drivers, we see a similar picture for
 SCMI and qcomtee.
 
 Aside from these, we see actual new hardware support in a few
 areas:
 
  - The Apple platform gets a new driver for low power states
 
  - Updates to Qualcomm platform drivers add several new
    hardware specific features and additional SoCs.
 
  - Amlogic SoC support for A1 and T7 is added
 
  - The Mediatek MMSYS driver is refactored as a cleanup.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqEtqAACgkQmmx57+YA
 GNlpfQ//VD7d15DccC3OJCsG9s9vBF0Hd7etv8ceX3PWbIuLon8QBOR91/uJaaYd
 33yWieJa3zNajOYqfNOAX7hD1N1UsXGmxJxpWcWlsfrhfXGiSctrQGxnOMdf0d6X
 LLhWR5Q+7H9utKSFshFzdUA0aDDvsQhSBl/zmnC68+qd105XAddaPMXmw5jfDNNQ
 6PO1f0iXwkkHel3Eq9EkNDomEWBndL7/s17f7IdRS0Sr+7iBp+Ey3ePG0sJ0MQBU
 H7IifUfMr5GxfVhIM9yVmnvLH07OhNunJyzKhQkCiWQzFa/8biNhEvGH4kJ67Is0
 XVB74chM/bo1EF6TVIY64ylpmCXPk5XWVwXZlhnwEI8npBFYrcSZJBAZ5vNUHMsT
 2Rw4lCczQemFaBFVGzNw+8j8K7712Sm1yfiU2LlN871JfGYxpeaC9N6o+NB8Oikt
 lS9fY8B3K2VzRM5w4Etp9SL3DPJ3N3LQ2gkCO0f/y+pu6n3IwrYGsJhocMOubcMn
 ImkI+StNUtCizWUGhHqcsOlXIdyoYRXx+Ex3y6hk1QqBIPNQHdY1lfkCXHicbpxf
 YVeUaelTGJp6mXFwx7Q10vD2679UyZYrMh4/cVsNskk1GlgDiiNCozVVdIa2/YnV
 qQNyoAzwPupI9fhyoFSoSzblhrESgTPnuTc6Rkl9I0y4ki3cqVM=
 =NeRc
 -----END PGP SIGNATURE-----

Merge tag 'soc-drivers-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC driver updates from Arnd Bergmann:
 "The SoC driver changes once more consist of many small fixes and
  cleanups, that are to a large part the result of automated testing.

  On platform specific drivers, this includes SoC specific code for
  xilinx, freescale/nxp, qualcomm, TI, aspeed, omap, tegra, samsung,
  rockchip, renesas, ixp4xx. In firmware drivers, we see a similar
  picture for SCMI and qcomtee.

  Aside from these, we see actual new hardware support in a few areas:

   - The Apple platform gets a new driver for low power states

   - Updates to Qualcomm platform drivers add several new hardware
     specific features and additional SoCs.

   - Amlogic SoC support for A1 and T7 is added

   - The Mediatek MMSYS driver is refactored as a cleanup"

* tag 'soc-drivers-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (157 commits)
  soc: qcom: make QCOM_PDR_MSG selectable
  soc: qcom: ubwc: Fix missing include
  soc: qcom: ubwc: Fix link error when QCOM_SMEM=n
  media: iris: Guard the QCOM_UBWC_CONFIG select with QCOM_SMEM
  drm/msm: Guard the QCOM_UBWC_CONFIG select with QCOM_SMEM
  dt-bindings: arm: qcom,ids: Add SoC ID for Snapdragon SDM 850
  firmware: xilinx: Clear firmware notifiers across kexec transitions
  firmware: xilinx: Release all peripheral devices from firmware
  firmware: xilinx: Add support to clear EL3 PM state
  firmware: xilinx: Propagate actual error from feature check
  firmware: xilinx: Use TF-A feature check for TF-A-specific APIs
  bus: fsl-mc: drop unused assignment of acpi_device_id::driver_data
  soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
  phy: lynx-10g: use RCW override procedure for dynamic protocol change
  soc: fsl: guts: implement the RCW override procedure
  dt-bindings: fsl: layerscape-dcfg: define DCFG_DCSR region
  soc: fsl: guts: make fsl_soc_data available after fsl_guts_init()
  soc: fsl: guts: make it easier to determine on which SoC we are running
  soc: fsl: guts: add a central fsl_guts_read() function
  soc: fsl: guts: add a global structure to hold state
  ...
2026-08-18 19:40:29 -07:00
Linus Torvalds
5808ac1889 - Get rid of static_cpu_has() - one less API to care about testing CPU
features
 
 - Unify the handling of CPU core types (performance, efficient, etc) by
   mapping the vendor-specific types to Linux ones
 
 - Continuation of the work of Ahmed Darwish to centralize CPUID leafs
   representation
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqEomYACgkQEsHwGGHe
 VUqrVhAAmN1E0HRaRm2zUcJqDS2TVz9a//LTWI/i9pNtlhPrdGrPtaHfps89TGj3
 1TBiFPE6I4xbuTlumFBToqfPbJ8mw41s3ZnlAUk/QVkf0J7Qkra/tZ9dRsWpjwqJ
 y/PqzgW7qTtpye881VX0fNaOlV4CRAQiGv6StALRo9fXn1lWRfwCfFBjYeuMHS0H
 e8r0shF0petS7JdHyTWmzS3E50ETrGI6XNbkKjWFyMjolaeP3r4YP1ucj/B5KY1E
 CFjdBkgXM3PQ0K4Nax96PA15VoMorIuGhpjiv0phiA9itBay3x6EQfOhXoMWtgiE
 9gbgUfWUCx/n+U5tXwOaZnFBd8gnyT0QOENmojEf8GCIBoGgeff0g6djNAm36QlF
 Zyfq7EOMBCfkooddWEz6qhZdeP7SwKz0i0dHyJ6OroQKXVjnCXAUveyA3/1venYb
 HT/xP/BNDQc4+GpO1ZPCuottpC6CVPclWsVOrcnU4jBtZJRhvNTWQMbDpZUFUefO
 FIJi40u1cnHw1hk7t5dVACJAME5p4hUz9hlfZFMETbkxjFH7cJEKaGFO2JXhSsui
 NaLkCJQWgnJynnhNhdycRsdbC6+pAiayoajGe80hiwYrr3j0YhG5UKSrgUwD6uiq
 CxuFt7C8jLEsAcWBILVB5+S6vh+3peHRAm9m9LtgiDpRAM4vGGI=
 =IKxX
 -----END PGP SIGNATURE-----

Merge tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 cpuid updates from Borislav Petkov:

 - Get rid of static_cpu_has() - one less API to care about testing CPU
   features

 - Unify the handling of CPU core types (performance, efficient, etc) by
   mapping the vendor-specific types to Linux ones

 - Continuation of the work of Ahmed Darwish to centralize CPUID leaf
   representation

* tag 'x86_cpu_for_v7.3_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/CPU: Rename struct cpuid_read_output to struct cpuid_output
  x86/cpu/scattered: Sort it properly
  x86/cpu: Use parsed CPUID(0x1)
  x86/lib: Add CPUID(0x1) family and model calculation
  x86/cpu: Use parsed CPUID(0x0)
  x86/cpu/transmeta: Rescan CPUID(0x1) after modifying capabilities
  x86/topology: Add TOPO_CPU_TYPE_LOW_POWER
  x86/topology: Name the AMD core-type values
  x86/topo: Map vendor CPU types to generic Linux such types
  x86/bugs: Don't use cpu-type matching in cpu_vuln_blacklist
  x86/cpu: Hide and rename static_cpu_has()
2026-08-18 19:09:42 -07:00
Linus Torvalds
d24f5cdbef Rust changes for v7.3
Toolchain and infrastructure:
 
  - Warn when using 'bindgen' < 0.72.1 with 'libclang' >= 22, since that
    combination may fail to build. It includes a probe for the bug in
    case 'bindgen' happens to be patched, and tests.
 
    In parallel, Nathan updated the instructions for the kernel.org
    LLVM+Rust toolchains so that the latest version of 'bindgen' is
    installed, which should avoid some of these situations.
 
  - Support testing 'rust_is_available.sh' with 'bash' as '/bin/sh'.
 
  - Fix an objtool warning by adding one more 'noreturn' function for
    Rust 1.99.0 (expected 2026-10-01).
 
  - Fix build error in the 'rusttest' target due to ambiguity when the
    'rustc-dev' component is installed, which was uncovered by the work
    to support Rust's GCC backend ('rustc_codegen_gcc').
 
  - Fix future Clang warnings in the upcoming powerpc support due to
    macro redefinitions in the UAPI helper header by including the
    arch-aware 'ioctl.h' header.
 
 'kernel' crate:
 
  - Rework module ownership support:
 
      - Move the module-related types into a new 'module' module and make
        the 'THIS_MODULE' pointer a constant of 'ModuleMetadata' so that
        modules can provide the pointer in const contexts, and add a
        'this_module' 'const fn' to retrieve it.
 
        This was enabled by upstream Rust's work on the 'const_mut_refs'
        and 'const_refs_to_static' features which were stabilized back
        in Rust 1.83.0.
 
      - Teach '#[vtable]' to associate implementations with their owning
        module, defaulting to the local one, including fallbacks for
        doctests, uses within the 'kernel' crate (like upcoming KUnit
        '#[test]'s for DRM) and 'rusttest'.
 
      - Set 'fops.owner' from the module pointer for DRM and miscdevice.
 
      - Migrate Rust Binder and configfs away from the old 'THIS_MODULE'
        'static' and finally remove it from the 'module!' macro.
 
  - 'num' module:
 
      - Add the new 'casts' module for lossless integer conversions.
 
        Rust's 'core' library's 'From' implementations do not cover
        conversions that are not portable or future-proof. However, the
        kernel supports a narrower set of architectures, which makes it
        helpful to provide more infallible conversions, instead of having
        developers use 'as' casts, which carry the risk of silently
        losing data.
 
        This goes along with previous work we did to avoid casts in Rust
        kernel code since they are more powerful than needed.
 
        Thus, provide safe 'const' conversion functions (e.g.
        'usize_as_u64' and 'u64_into_u8'), as well as the 'FromSafeCast'
        and 'IntoSafeCast' extension traits that provide conversions that
        are known to be lossless in the kernel, and an 'arch' submodule
        defining conversions that are known to be lossless on particular
        architectures (e.g. 64-bit platforms). For instance:
 
            // Conversion in const context.
            const USIZED_CONST: usize = u8_as_usize(255u8);
 
            // Non-const conversions.
            let a = u64::from_safe_cast(4096usize);
            let b: u64 = 4096usize.into_safe_cast();
 
      - Add 'Bounded::shr_exact' method in the vein of 'try_shrink' which
        shifts a bounded right only if it loses no set bits.
 
      - Fix unsoundness issue in the 'Bounded::shr' method by rejecting,
        at compile-time, shifts of at least the type's bit width.
 
  - 'fmt' module:
 
      - Route '{:p}' raw pointer formatting through the kernel's hashed
        '%p' format to prevent address leaks, including support for width
        and padding. Include tests for both 'no_hash_pointers' case and
        the default (hashed) one.
 
      - Fix the '{:p}' forwarding implementation, which could print the
        address of a temporary stack variable.
 
  - 'time' module:
 
      - Make 'Delta' generic over its time unit, with a default unit of
        nanoseconds ('Nsec'), preserving the existing behavior. Then, add
        a 'Jiffy' time unit.
 
      - Add the 'Delta::as_millis_ceil()' method.
 
      - Fix 'as_micros_ceil()' rounding near 'i64::MAX', which could
        yield a result one microsecond too small.
 
  - 'sync' module:
 
      - Implement 'ForeignOwnable' for 'ARef<T>', allowing C code to own
        an 'ARef<T>'.
 
      - Add a safe abstraction for 'rcu_barrier()'.
 
  - 'error' module: add all of the remaining error codes, except the
    deprecated compatibility aliases.
 
  - 'bug' module:
 
      - Fix build error on UML in 'warn_on!' for callers from within
        the 'kernel' crate.
 
      - Fix future 'dead_code' warning on arm and loongarch64 and under
        'CONFIG_BUG=n' in 'warn_on!', which would trigger with the
        upcoming SRCU abstractions.
 
      - Fix future build error in 'rusttest' on cross-compilation cases,
        which would trigger when 'warn_on!' has callers inside the
        'kernel' crate.
 
  - 'bitfield' module: fix build error for the upcoming support for
    Rust's GCC backend ('rustc_codegen_gcc') by always inlining a couple
    conversions used in tests.
 
 'pin-init' crate:
 
  - User-visible changes:
 
      - Merge the '__pinned_init' and '__init' methods and make 'Init'
        a marker trait.
 
      - Introduce public APIs 'raw_init' and 'raw_try_init' to prevent
        users from needing to invoke the internal
        '__pinned_init'/'__init' methods.
 
      - Emit errors for duplicate '#[pin]' attributes.
 
      - Link 'Zeroable::zeroed' and 'pin_init::zeroed' in documentation.
 
  - Other changes:
 
      - Fix unwind safety issues.
 
      - Clean up lint 'allow' and 'expect's.
 
      - Overhaul '#[cfg]' handling to pave the way for tuple structs and
        self-referential structs.
 
      - Mark many functions as '#[inline]' for better codegen with '-C
        opt-level=s' ('CC_OPTIMIZE_FOR_SIZE').
 
 'MAINTAINERS':
 
  - Update 'MODULE SUPPORT' to cover the new 'module' module.
 
 And some other fixes, cleanups and improvements.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmqCCJQACgkQGXyLc2ht
 IW3ErA//e5gz1OEDalINpUt1zYktodleilyxvaUkoR0Q0T+pQIgoMniD7OWxPCPG
 G6Qq/bBEPezwuMncJizsc3Gj9h9/KEPfZXaDYPt/p0rdVL4Ej5gOzpOWM1lB4XCA
 z2xgOwVSyY6Go6sTEru1tG8Qs7v72NmjqIf1088K+6NQ9CVwWBL78arXzIuzi4L/
 rK829rV/8evCxomQxCNN3Nb7VYXpmavRLqXvbF3mt8AAAkqlbF8I2DVZusZNJpNT
 0b9fpefw4Im8zwaXMP1Tiw1RCV8rAATKDjJARNEh0jUEKfJ6KGnO7hDqx0k7HGYG
 9T+ZLTSV4i24J2hs3f1+atN4rScPntpOSxUylBgPsregj2jdbUwWs80PdtzePBPD
 rxpUXY/1zFT0JcC9qkgnBwB7OXwR0GmLQdf70OtSj3SgVQnsulHv7Xe/BIXtxCkR
 +I88//hHssEIkyHvi2Q+F1id+aj3ag05UuKivE+pgs7rIINoOSO8B0XPRGmeXYeC
 uo+OTHz/wzq1/7qR/a/rTw28fW/H7gc/06c29qQagfuwrZz4rVzpaZrh7DyZEm18
 t4m+rtJ2Ccw8vmkl6Y8axx3nlRhaIICIlSgv2iGULYYOH5jZ9tdBAqxXxHlcCyLw
 Ns9n95MYvbLXDlO0+Woz4Y6Ltdz1BXXubH881WRQL4Zck3LJ10g=
 =4uyP
 -----END PGP SIGNATURE-----

Merge tag 'rust-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull Rust updates from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Warn when using 'bindgen' < 0.72.1 with 'libclang' >= 22, since
     that combination may fail to build. It includes a probe for the bug
     in case 'bindgen' happens to be patched, and tests

     In parallel, Nathan updated the instructions for the kernel.org
     LLVM+Rust toolchains so that the latest version of 'bindgen' is
     installed, which should avoid some of these situations

   - Support testing 'rust_is_available.sh' with 'bash' as '/bin/sh'

   - Fix an objtool warning by adding one more 'noreturn' function for
     Rust 1.99.0 (expected 2026-10-01)

   - Fix build error in the 'rusttest' target due to ambiguity when the
     'rustc-dev' component is installed, which was uncovered by the work
     to support Rust's GCC backend ('rustc_codegen_gcc')

   - Fix future Clang warnings in the upcoming powerpc support due to
     macro redefinitions in the UAPI helper header by including the
     arch-aware 'ioctl.h' header

  'kernel' crate:

   - Rework module ownership support:

       - Move the module-related types into a new 'module' module and
         make the 'THIS_MODULE' pointer a constant of 'ModuleMetadata'
         so that modules can provide the pointer in const contexts, and
         add a 'this_module' 'const fn' to retrieve it

         This was enabled by upstream Rust's work on the 'const_mut_refs'
         and 'const_refs_to_static' features which were stabilized back
         in Rust 1.83.0

       - Teach '#[vtable]' to associate implementations with their
         owning module, defaulting to the local one, including fallbacks
         for doctests, uses within the 'kernel' crate (like upcoming
         KUnit '#[test]'s for DRM) and 'rusttest'

       - Set 'fops.owner' from the module pointer for DRM and
         miscdevice

       - Migrate Rust Binder and configfs away from the old
         'THIS_MODULE' 'static' and finally remove it from the 'module!'
         macro

   - 'num' module:

       - Add the new 'casts' module for lossless integer conversions

         Rust's 'core' library's 'From' implementations do not cover
         conversions that are not portable or future-proof. However, the
         kernel supports a narrower set of architectures, which makes it
         helpful to provide more infallible conversions, instead of
         having developers use 'as' casts, which carry the risk of
         silently losing data

         This goes along with previous work we did to avoid casts in
         Rust kernel code since they are more powerful than needed

         Thus, provide safe 'const' conversion functions (e.g.
         'usize_as_u64' and 'u64_into_u8'), as well as the
         'FromSafeCast' and 'IntoSafeCast' extension traits that provide
         conversions that are known to be lossless in the kernel, and an
         'arch' submodule defining conversions that are known to be
         lossless on particular architectures (e.g. 64-bit platforms).
         For instance:

             // Conversion in const context.
             const USIZED_CONST: usize = u8_as_usize(255u8);

             // Non-const conversions.
             let a = u64::from_safe_cast(4096usize);
             let b: u64 = 4096usize.into_safe_cast();

       - Add 'Bounded::shr_exact' method in the vein of 'try_shrink'
         which shifts a bounded right only if it loses no set bits

       - Fix unsoundness issue in the 'Bounded::shr' method by
         rejecting, at compile-time, shifts of at least the type's bit
         width

   - 'fmt' module:

       - Route '{:p}' raw pointer formatting through the kernel's hashed
         '%p' format to prevent address leaks, including support for
         width and padding. Include tests for both 'no_hash_pointers'
         case and the default (hashed) one

       - Fix the '{:p}' forwarding implementation, which could print the
         address of a temporary stack variable

   - 'time' module:

       - Make 'Delta' generic over its time unit, with a default unit of
         nanoseconds ('Nsec'), preserving the existing behavior. Then,
         add a 'Jiffy' time unit

       - Add the 'Delta::as_millis_ceil()' method

       - Fix 'as_micros_ceil()' rounding near 'i64::MAX', which could
         yield a result one microsecond too small

   - 'sync' module:

       - Implement 'ForeignOwnable' for 'ARef<T>', allowing C code to
         own an 'ARef<T>'

       - Add a safe abstraction for 'rcu_barrier()'

   - 'error' module: add all of the remaining error codes, except the
     deprecated compatibility aliases

   - 'bug' module:

       - Fix build error on UML in 'warn_on!' for callers from within
         the 'kernel' crate

       - Fix future 'dead_code' warning on arm and loongarch64 and under
         'CONFIG_BUG=n' in 'warn_on!', which would trigger with the
         upcoming SRCU abstractions

       - Fix future build error in 'rusttest' on cross-compilation
         cases, which would trigger when 'warn_on!' has callers inside
         the 'kernel' crate

   - 'bitfield' module: fix build error for the upcoming support for
     Rust's GCC backend ('rustc_codegen_gcc') by always inlining a
     couple conversions used in tests

  'pin-init' crate:

   - User-visible changes:

       - Merge the '__pinned_init' and '__init' methods and make 'Init'
         a marker trait

       - Introduce public APIs 'raw_init' and 'raw_try_init' to prevent
         users from needing to invoke the internal '__pinned_init' and
         '__init' methods

       - Emit errors for duplicate '#[pin]' attributes

       - Link 'Zeroable::zeroed' and 'pin_init::zeroed' in documentation

   - Other changes:

       - Fix unwind safety issues

       - Clean up lint 'allow' and 'expect's

       - Overhaul '#[cfg]' handling to pave the way for tuple structs
         and self-referential structs

       - Mark many functions as '#[inline]' for better codegen with '-C
         opt-level=s' ('CC_OPTIMIZE_FOR_SIZE')

  'MAINTAINERS':

   - Update 'MODULE SUPPORT' to cover the new 'module' module

  And some other fixes, cleanups and improvements"

* tag 'rust-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (54 commits)
  rust: add functions and traits for lossless integer conversions
  rust: kernel: add `LocalModule` fallback for `#[vtable]` `impl`s
  rust: fmt: route {:p} through HashedPtr to prevent address leaks
  rust: fmt: fix {:p} printing stack addresses
  rust: module: update MAINTAINERS to cover module.rs
  rust: macros: remove `THIS_MODULE` static from `module!`
  rust_binder: use `LocalModule` for `THIS_MODULE`
  rust: configfs: use `LocalModule` for `THIS_MODULE`
  rust: miscdevice: set fops.owner from driver module pointer
  rust: drm: set fops.owner from driver module pointer
  rust: macros: auto-insert OwnerModule in #[vtable]
  rust: doctest: add LocalModule fallback for #[vtable] ThisModule
  rust: module: add `THIS_MODULE` const to `ModuleMetadata` trait
  rust: module: move module types into `module.rs`
  rust: num: add Bounded::shr_exact
  rust: num: reject Bounded::shr overshifts at build time
  rust: num: use const_assert! in Bounded
  rust: uapi: replace direct asm-generic/ioctl.h include with linux/ioctl.h
  rust: time: add Delta::as_millis_ceil()
  rust: time: add jiffies time unit for Delta
  ...
2026-08-18 11:25:09 -07:00
Daniel Baluta
a1ee4bb25b drm/msm: Guard the QCOM_UBWC_CONFIG select with QCOM_SMEM
QCOM_UBWC_CONFIG is about to depend on QCOM_SMEM. Guard the DRM_MSM
select with 'if ARCH_QCOM && QCOM_SMEM', and add
'depends on QCOM_SMEM || QCOM_SMEM=n' so a built-in driver is never
selected against a missing or modular SMEM.

Fixes: 1b445022d1 ("soc: qcom: ubwc: Get HBB from SMEM")
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Acked-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
Tested-by: Nathan Chancellor <nathan@kernel.org> # build
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-18 11:17:45 +02:00
Dave Airlie
b2601e783a Driver Changes:
- Fix DPT Allocation paths (Maarten)
 - Fixes around UM queue BO (Jia)
 - Order ring writes before ring tail updates (Matthew Brost)
 - Add termination on resume for PXP (Daniele)
 - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra)
 - Fix sync entry leak on OA config emit failure (Linmao Li)
 - Check managed mutex initilization errors (Linmao Li)
 - Fix min frequency setting (Vinay)
 - Fix xe_device_probe error path (Raag)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRskUM7w1oG5rx2IZO4FpNVCsYGvwUCan4Y0QAKCRC4FpNVCsYG
 vw4gAQD/56NgUmv0Rx3BsDCQhjCMb99DtTGbnEvhehmb6nJ0gQD/eBPPDmobVJYZ
 P0pGk6B014FrmH+PDjD9Vo2EbswLFQE=
 =ez0c
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2026-08-13' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

Driver Changes:
- Fix DPT Allocation paths (Maarten)
- Fixes around UM queue BO (Jia)
- Order ring writes before ring tail updates (Matthew Brost)
- Add termination on resume for PXP (Daniele)
- Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra)
- Fix sync entry leak on OA config emit failure (Linmao Li)
- Check managed mutex initilization errors (Linmao Li)
- Fix min frequency setting (Vinay)
- Fix xe_device_probe error path (Raag)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/an4ZogmPqP2Xtfx3@fedora
2026-08-14 15:41:40 +10:00
Dave Airlie
7581e7c73e drm-misc-fixes for v7.3:
- Revert fair scheduler patches and mark fair policy as experimental due
   to reported regressions.
 - Fix OOB read in connector/hdmi infoframe.
 - Handle invalid scaling parameters and empty messages in log target.
 - Skip attempting to populate unmapped pages in amdxdna.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAmp936wACgkQ/lWMcqZw
 E8MzVA//aKT/DVfDA9dUljxQS70lC17W0a9sf16rpQsftuRxCUci1x2kXJG5sIGa
 MaKdxmP8PaR0J+xNC/2rGuk2cyKiQxd4BaRnNYXHY4pLG8FbUmSbhWMrICgxj9XE
 DUBDXzwqjfq7lxXRsKsqARhkn4rHzb9TS84YeQaUZuuwgL2AbDeSEGZkXMTxKCuJ
 0sDD8kklVNJKn4ofke5za3KWJ1gIWP/y+kosmi38kG8oZ5M3Uen6JXv/mp0VhMMd
 UAM+vRUFtWmkYVTsvxC9BXxdo6nqMUWRviXAeHnt6BijuysQ0ZAIuFvnf7/o+Knu
 NXDABvoZFuFm6pP4t3BSEX2M2RrwczxfvT465UvYaoLwgLutGxwP4AvmWE4vLe32
 5pNQLpfllCkxZeOYuxewTEfWLhykxF8wnSeVy9l6II+/OpkPnUjDAFJkDHcaTk+V
 dPPmPZrOGC/LeLtD7JYbhRX6FkNQzTKNLjXSDjt3w/Sori3nhXkSAuj0zFDM7rHj
 KAnXh6B4j3vOAbqUEOHmabLqoRmlgpfP30NSyvLc47hMqvHJj+YV9V+5Ay1Yg3Sh
 otMusvCZY/vpwvVhlFS45XA8k81YdjnxmUqLrQceJS/KGYHt5Qzc1kP2JynjX+D7
 /byp/TzTuBnO8cdXaDz58coAEPdoyfGSjH2qVYs4FgeT06ZPOYQ=
 =Stgd
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2026-08-13' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

drm-misc-fixes for v7.3:
- Revert fair scheduler patches and mark fair policy as experimental due
  to reported regressions.
- Fix OOB read in connector/hdmi infoframe.
- Handle invalid scaling parameters and empty messages in log target.
- Skip attempting to populate unmapped pages in amdxdna.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patch.msgid.link/a9b38792-bdd0-42da-a46a-7a048c26c0c2@linux.intel.com
2026-08-14 13:19:08 +10:00
Shixiong Ou
f4f2bba28d drm/log: Fix infinite loop when scale is too large for display
When scale is large enough that scaled_font exceeds the display
dimensions, rows or columns become 0. A columns value of 0 causes
an infinite loop in drm_log_draw_kmsg_record() because the loop
never decrements len.

Check for zero rows/columns in drm_log_setup_modeset() and return
an error, cleaning up the already allocated buffer to avoid a leak.

Fixes: 8a4b913df4 ("drm/log: Add integer scaling support")
Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Link: https://patch.msgid.link/20260729084815.692944-1-oushixiong1025@163.com
Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
2026-08-13 15:49:40 +02:00
Shixiong Ou
60baa179ed drm/log: Fix out-of-bounds read on empty message length
drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing
newline, but len is unsigned int. If len is 0, the subtraction wraps
to UINT_MAX, causing an out-of-bounds read.

Add an early return when len is 0.

Fixes: 25e2c2a3ef ("drm/log: Color the timestamp, to improve readability")
Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Link: https://patch.msgid.link/20260729084520.688087-1-oushixiong1025@163.com
Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
2026-08-13 15:47:50 +02:00
Shixiong Ou
921ac6cb06 drm/log: Fix division by zero when scale module parameter is 0
The scale module parameter can be set to 0 via kernel command line.
When scale is 0, scaled_font_h and scaled_font_w become 0, causing
a division by zero in the rows/columns calculation.

Since the scale module parameter is read-only (0444 permissions), it
cannot be changed at runtime via sysfs. Clamp it to 1 once in
drm_log_register().

Fixes: 8a4b913df4 ("drm/log: Add integer scaling support")
Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Link: https://patch.msgid.link/20260730014440.66323-1-oushixiong1025@163.com
Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>
2026-08-13 15:46:50 +02:00
Raag Jadav
ef526d122b drm/xe: Fix xe_device_probe() failure
Currently, xe_device_probe() jumps to err_unregister_display label in case
of failure except for its last call, which directly returns the error
without required cleanup handling. This results in stale drm device that
isn't cleaned up on unwind. Fix it.

[  810.194180] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/drm/renderD128'
[  810.194183] CPU: 9 UID: 0 PID: 5616 Comm: modprobe Kdump: loaded Tainted: G S   U      E       7.2.0-rc2-xe #382 PREEMPT(full)
[  810.194185] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER, [E]=UNSIGNED_MODULE
[  810.194186] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 1805 10/30/2024
[  810.194186] Call Trace:
[  810.194187]  <TASK>
[  810.194188]  dump_stack_lvl+0xe0/0x100
[  810.194195]  dump_stack+0x14/0x20
[  810.194197]  sysfs_warn_dup+0x5f/0x80
[  810.194204]  sysfs_create_dir_ns+0xbe/0xd0
[  810.194210]  kobject_add_internal+0xbc/0x2b0
[  810.194215]  kobject_add+0x7c/0xe0
[  810.194220]  ? get_device_parent+0xcf/0x1e0
[  810.194227]  device_add+0xe3/0x870
[  810.194231]  ? __pfx_drm_gem_name_info+0x10/0x10 [drm]
[  810.194280]  drm_minor_register+0x73/0x130 [drm]
[  810.194322]  drm_dev_register+0x76/0x2a0 [drm]

Cc: stable@vger.kernel.org
Fixes: da3799c975 ("drm/xe: Use GuC to do GGTT invalidations for the GuC firmware")
Signed-off-by: Raag Jadav <raag.jadav@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/20260810123821.105605-1-raag.jadav@intel.com
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
(cherry picked from commit 5ce3042c67)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:34 +02:00
Vinay Belgaumkar
5cf82c8cec drm/xe: Fix a bug in pc_adjust_freq_bounds()
In cases where min frequency was actually greater than BMG_MIN_FREQ,
we were not using the updated min frequency as there was a missing
call to pc_action_query_task_state() between the two settings of
min frequency. Since we know what min_freq was last set, use that
cached value while comparing to BMG_MIN_FREQ to fix this issue.

v2: pc->freq_ready is not set until after pc_adjust_freq_bounds(). Stay
with pc_action_query_task_state() instead.

v3: Update commit message (Stuart)

Fixes: bdde16c9ac ("drm/xe/bmg: Update Wa_14022085890")
Signed-off-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
Signed-off-by: Vinay Belgaumkar <vinay.belgaumkar@intel.com>
Reviewed-by: Stuart Summers <stuart.summers@intel.com>
Link: https://patch.msgid.link/20260805234649.2076384-1-vinay.belgaumkar@intel.com
(cherry picked from commit a2c2d2b13a)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:34 +02:00
Linmao Li
f110dbbfa2 drm/xe/oa: Check managed mutex initialization errors
drmm_mutex_init() can fail while registering its managed cleanup action.
On failure, the reset path destroys the mutex, so continuing OA setup
leaves an unusable lock that later paths may acquire.

Return the error from per-GT OA initialization and abort device-wide OA
initialization if the metrics lock cannot be initialized.

Fixes: a9f905ae7b ("drm/xe/oa/uapi: Initialize OA units")
Fixes: cdf02fe1a9 ("drm/xe/oa/uapi: Add/remove OA config perf ops")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Link: https://patch.msgid.link/20260713083053.321091-1-lilinmao@kylinos.cn
(cherry picked from commit 360b293de2)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:33 +02:00
Linmao Li
8d33c4987c drm/xe/oa: Fix sync entry leak on OA config emit failure
xe_oa_emit_oa_config() releases the sync entries and the syncs array
only on its success path. When it fails before the point of no return
(fence allocation, config buffer allocation or batch submission), it
returns without touching stream->syncs.

The stream open path handles such failures in the caller, but
xe_oa_config_locked() propagates the error without any cleanup, so the
syncs array and the fence references held by the parsed entries are
leaked. The next config ioctl overwrites stream->syncs, making the
memory unreachable for good.

Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching
the cleanup done by the stream open error path.

Fixes: 9920c8b88c ("drm/xe/oa: Add syncs support to OA config ioctl")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Link: https://patch.msgid.link/20260731011932.3426219-1-lilinmao@kylinos.cn
(cherry picked from commit 8af97b3da2)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:33 +02:00
Gajendra Uttamchand
cb4afddf9e drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe
Problem: CTX_TIMESTAMP MMIO reads could be stale if a context
switched out between check and read; LRC stores a sentinel while
a context starts that must not be treated as a real timestamp.

Fix: Check the LRC-stored sentinel before and after the MMIO read;
return the LRC value if the context switched out to avoid TOCTOU.

Note: Keep XE_LRC_CTX_TIMESTAMP_ACTIVE in xe_lrc.h as the
canonical sentinel.

Fixes: d243ef6a39 ("drm/xe/lrc: Refactor xe_lrc_timestamp to simplify logic")
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7956
Assisted-by: GitHub-Copilot:claude-sonnet-5
Signed-off-by: Gajendra Uttamchand <gajendra.uttamchand@intel.com>
Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Acked-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Link: https://patch.msgid.link/20260810071812.213358-4-gajendra.uttamchand@intel.com
(cherry picked from commit a806534474)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:33 +02:00
Daniele Ceraolo Spurio
51afaf53e0 drm/xe/pxp: add termination on resume
Suspend/resume causes the PXP keys to become invalid, but doesn't
actually kill the session. The driver also doesn't explicitly kill and
re-start the session until a new PXP request comes in, which means that
the "zombie" session can potentially stick around if there are no new
requests from userspace. While this is not an issue for PXP, HDCP has a
new behavior starting on PTL where a communication is sent to GSC if a
session is active at suspend time (even if it doesn't have a valid key),
which can lead to delays in the suspend flow if we suspend while the
zombie session is still active.
To avoid this, we can trigger a termination on resume and kill the
zombie session immediately, instead of delaying the termination to the
next PXP request. Due to restrictions in the rpm suspend/resume flow, we
can't call the termination flow from within the resume call itself, so
the pxp irq worker is expanded to cover this scenario.
The existing logic in the worker doesn't work as-is for the new flow,
because the pm_get_if_active will fail if the worker runs before the
pci_resume call has completed (which is possible, since we queue it
from within that call) or after we're started to suspend again.
Given that we always want to run the worker after a resume (differently
from the irq case, where we want to skip if we're suspended), we can
solve this by just taking the PM reference before queueing the worker.
As part of this rework, the pxp->events variable has been moved to atomic,
to avoid having to take xe->irq.lock from non-irq related paths.

Fixes: b1dcec9bd8 ("drm/xe/ptl: Enable PXP for PTL")
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Julia Filipchuk <julia.filipchuk@intel.com>
Cc: Alan Previn <alan.previn.teres.alexis@intel.com>
Reviewed-by: Alan Previn <alan.previn.teres.alexis@intel.com>
Link: https://patch.msgid.link/20260720222757.3876338-2-daniele.ceraolospurio@intel.com
(cherry picked from commit 757bda2b8b)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:33 +02:00
Matthew Brost
9f83c94469 drm/xe: Order ring writes before ring tail updates
The ring buffer and the LRC context image are both mapped WC, so the ring
tail update can become visible to the device before the ring contents it
is meant to publish.

The GuC CT send does contain an xe_device_wmb(), so sending the H2G would
flush the ring contents. The problem is that it comes too late:
xe_lrc_set_ring_tail() publishes the tail before the H2G is sent, and the
device samples the tail from the context image independently of it, either
at context switch-in or while the context is already resident. A submitter
which is interrupted between updating the tail and sending its H2G
therefore leaves the device free to observe the new tail while the ring
contents behind it are not yet visible:

  1. Thread A emits a job into the ring, sets the tail to T_A and sends
     the H2G, which flushes A's ring contents. The GuC starts scheduling
     the context in, but it is not executing yet.
  2. Thread B emits a job into ring[T_A..T_B]. Those writes are not yet
     visible to the device.
  3. Thread B updates the ring tail to T_B. That write targets a
     different page and becomes visible first.
  4. Thread B is interrupted before it sends its H2G, so the flush which
     would have published ring[T_A..T_B] has not happened yet.
  5. The context is switched in and samples the ring tail from the
     context image, picking up T_B rather than T_A.
  6. The GPU executes A's job, advances HEAD to T_A, and continues on to
     ring[T_A..T_B], which still holds the previous wrap's contents, so
     the CS parses stale commands.

The result is command stream corruption, which typically manifests as a
hang or a spurious pagefault rather than anything that points back at the
submission path.

Kernel jobs are by far the most likely to hit this. Kernel queues such as
the migration queue are shared and can be driven by many threads
concurrently, producing back-to-back submissions on an LRC which is
already executing. User queues are typically tied to a single submitting
thread, so the same interleaving is much harder to produce.

Add an xe_device_wmb() at the end of xe_lrc_write_ring() so that it covers
every ring tail publication site, and so the invariant is local: once
xe_lrc_write_ring() returns, the ring contents are visible to the device.

Fixes: dd08ebf6c3 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8651
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7810
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Assisted-by: GitHub_Copilot:claude-opus-5
Reviewed-by: Stuart Summers <stuart.summers@intel.com>
Link: https://patch.msgid.link/20260807171716.140475-1-matthew.brost@intel.com
(cherry picked from commit 136360290f)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:33 +02:00
Jia Yao
8d5134ae41 drm/xe/guc_ads: use uncached mapping for UM queue BO
On Pre-Xe3p platform, the GAM write the UM queue through DPA using UC.
if GuC reads the queue via GGTT (WB), stale data may be observed
when the cacheline has been polluted by another agent.

To match the GAM's UC writes, configure the GuC mapping as UC as well.

Fixes: 9c57bc0865 ("drm/xe/lnl: Drop force_probe requirement")
Cc: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: <stable@vger.kernel.org> # v6.12+
Signed-off-by: Jia Yao <jia.yao@intel.com>
Reviewed by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260804165057.129529-4-jia.yao@intel.com
(cherry picked from commit 9daa302a82)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:33 +02:00
Jia Yao
f342810a14 drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
On iGPU, the UM queue BO is allocated in system memory. On dGFX, the BO
was previously created in system memory and later reallocated in
xe_guc_realloc_post_hwconfig().  Allocate the UM queue BO directly in
VRAM on dGFX, where it is ultimately required.

Fixes: 9c57bc0865 ("drm/xe/lnl: Drop force_probe requirement")
Cc: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: <stable@vger.kernel.org> # v6.12+
Signed-off-by: Jia Yao <jia.yao@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260804165057.129529-3-jia.yao@intel.com
(cherry picked from commit ace076ef0a)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:33 +02:00
Jia Yao
99b0181595 drm/xe/guc_ads: allocate UM queues in a separate BO
Move the UM queues into a dedicated BO (ads->um_queue_bo) and avoid
CPU memset operations on it, which eliminates the CPU as a potential
cacheline-polluting agent and helps maintain consistency between GAM
writes and GuC reads.

We also need to ensure the base_dpa for the queue is contiguous on hw
where this is used instead of a GGTT address. Another good reason to
split this out to a separate BO.

Fixes: 9c57bc0865 ("drm/xe/lnl: Drop force_probe requirement")
Cc: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: <stable@vger.kernel.org> # v6.12+
Signed-off-by: Jia Yao <jia.yao@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260804165057.129529-2-jia.yao@intel.com
(cherry picked from commit 6af05de0dc)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:33 +02:00
Maarten Lankhorst
fc64875790 drm/xe: Fix DPT allocation paths.
Remove the fallback for VRAM to system memory, I tested it and that
doesn't work at all, only a black screen with pipe fault errors were
observed.

On systems with media GT, extra latency is added when accessing stolen
memory when the GT is in MC6. Since we additionally aren't counting how
much memory is used for stolen and we could in theory fill up the
entire stolen area with DPT's, avoid using stolen and only use the
default memory region.

Using stolen may also result in random system hangs under load.

Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/7513
Fixes: 775d0adc01 ("drm/xe/fbdev: Limit the usage of stolen for LNL+")
Cc: <stable@vger.kernel.org> # v6.12+
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260630135523.1775379-2-dev@lankhorst.se
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Acked-by: Matthew Brost <matthew.brost@intel.com> #teams
(cherry picked from commit a196406a38)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-08-13 14:56:33 +02:00
Lijo Lazar
ac828b94e0 drm/amdgpu: Prefer default discovery offset
If a valid signature is seen at the default offset, use the default
size/offset for discovery.

Fixes: 01bdc7e219 ("drm/amdgpu: New interface to get IP discovery binary v3")
Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/5447
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 46a0df99a0)
Cc: stable@vger.kernel.org
2026-08-12 10:23:07 -04:00
David Rosca
9fca434208 drm/amdgpu: Reject UVD message with invalid number of h265 refs
Same change as for h264, avoids overflow later when calculating
min dpb size.

Signed-off-by: David Rosca <david.rosca@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit a4b0720e4f)
Cc: stable@vger.kernel.org
2026-08-12 10:23:01 -04:00
Yang Wang
cd688a3cb3 drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
The PCIe L1 low‑power settings for NBIF 6.3.1 were never applied due to
unresolved register mapping, which caused the relevant code to be compiled out.
As a result, the PCIe link could not enter L1/L23 power‑down states or transition to L0s.

Properly configure the link control register to enable L1 and L23 power‑down,
and permit L0s link transitions. Keep LTR disabled and let the PCI core enable it
only after verifying end‑to‑end root complex support across switches.

Fixes: 894c6d3522 ("drm/amdgpu: Add nbif v6_3_1 ip block support")
Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Signed-off-by: Kenneth Feng <Kenneth.feng@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c2417f9fd7)
Cc: stable@vger.kernel.org
2026-08-12 10:22:53 -04:00
Nathan Lucas
cd22349e86 drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
The commit cited by the Fixes tag added separate limited and full-range
BT.2020 YCbCr entries to the DCE output CSC tables, but populated both
entries with the same matrix copied from the common DC table. That
matrix combined full-range scaling with limited-range luma offset and was
incorrect for both limited and full-range output.

Replace the coefficients in both entries in the DCE paths with those from
the new COLOR_SPACE_YCBCR2020_LIMITED_TYPE
and COLOR_SPACE_YCBCR2020_FULL_TYPE entries in the preceding commit
("drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix").

Fixes: 51e6668ab4 ("drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs")
Assisted-by: OpenAI-Codex:GPT-5.6-Sol
Tested-by: Igor Paunovic <royalnet026@gmail.com>
Tested-by: Satyajit Roy <sroy14@alum.utk.edu>
Signed-off-by: Nathan Lucas <nlucasgit@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 14c8726b79)
Cc: stable@vger.kernel.org
2026-08-12 10:22:47 -04:00
Nathan Lucas
2f9a5c0f01 drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
COLOR_SPACE_YCBCR2020_TYPE, which is selected for
COLOR_SPACE_2020_YCBCR_LIMITED color_space, has coefficients that are
incorrect for limited-range output. Its luma and chroma scaling is
full-range so output is too bright and colors are incorrect.

COLOR_SPACE_YCBCR2020_TYPE is closer to a full-range conversion matrix with
incorrect luma offset, so correct the luma offset for full-range and rename
it to COLOR_SPACE_YCBCR2020_FULL_TYPE.

Add COLOR_SPACE_YCBCR2020_LIMITED_TYPE with correct scaling and range for
limited-range output.

Fix related functions so COLOR_SPACE_YCBCR2020_LIMITED_TYPE and
COLOR_SPACE_YCBCR2020_FULL_TYPE are correctly selected based on
dc_color_space.

Derivation of both matrices follows ITU-T H.273:

Table 4, MatrixCoefficients 9, BT.2020-NCL weights:
KR = 0.2627, KB = 0.0593, KG = 1 - KR - KB = 0.6780.

Equations 45-47 in matrix form:
            [  KR             KG             KB            0 ]
M2020_NCL = [ -KR/(2(1-KB))  -KG/(2(1-KB))   1/2           0 ]
            [  1/2           -KG/(2(1-KR))  -KB/(2(1-KR))  0 ]
            [  0              0              0             1 ]

Limited and Full transforms based on equations 30-32 and 36-38 with bit
depth 10, normalized by 1023:

            [ 876/1023   0         0         64/1023  ]
MLimited  = [ 0          896/1023  0         512/1023 ]
            [ 0          0         896/1023  512/1023 ]
            [ 0          0         0         1        ]

            [ 1023/1023  0         0         0        ]
    MFull = [ 0          1023/1023 0         512/1023 ]
            [ 0          0         1023/1023 512/1023 ]
            [ 0          0         0         1        ]

M2020_NCL_Limited = MLimited x M2020_NCL
M2020_NCL_Full    = MFull x M2020_NCL

The upper three rows of M2020_NCL_* are stored in CR, Y, CB order. Each
M2020_NCL_* value is stored as Round(value * 8192) in its 16-bit
two's-complement representation.

Fixes: 973a9c810c ("drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix")
Assisted-by: OpenAI-Codex:GPT-5.6-Sol
Tested-by: Igor Paunovic <royalnet026@gmail.com>
Tested-by: Satyajit Roy <sroy14@alum.utk.edu>
Signed-off-by: Nathan Lucas <nlucasgit@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 3b906e1dc7)
Cc: stable@vger.kernel.org
2026-08-12 10:22:39 -04:00
David Rosca
d5ab4c6a64 drm/amdgpu: Implement insert_end for VCE 3
After a recent change VCE now hangs when VCE_CMD_END is emitted
after a pipeline sync without VM flush.
Implement insert_end to correctly insert only one VCE_CMD_END per job.

Fixes: bc639a9ead ("drm/amdgpu: always emit the job vm fence")
Signed-off-by: David Rosca <david.rosca@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 8897ea8c76)
Cc: stable@vger.kernel.org
2026-08-12 10:22:31 -04:00
David Rosca
18727670b4 drm/amdgpu: Fix UVD min buffer sizes
Use correct size for message buffer = sizeof(struct ruvd_msg).
Add ITSCALING_TABLE_BUFFER size.

Signed-off-by: David Rosca <david.rosca@amd.com>
Acked-by: Leo Liu <leo.liu@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 37519d007e)
Cc: stable@vger.kernel.org
2026-08-12 10:22:24 -04:00
David Rosca
b8bb9ba3f1 drm/amdgpu: Fix UVD decode image min size calculation
This needs to use pitch instead of width. Also reject pitch
over 4096 to avoid overflow.

Signed-off-by: David Rosca <david.rosca@amd.com>
Acked-by: Leo Liu <leo.liu@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b41c8cb12e)
Cc: stable@vger.kernel.org
2026-08-12 10:22:17 -04:00
David Rosca
21a8084cd7 drm/amdgpu: Fix UVD dpb min size calculation for H264
This should use actual number of references from the decode
message, instead of maximum derived from level.

Signed-off-by: David Rosca <david.rosca@amd.com>
Acked-by: Leo Liu <leo.liu@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 64b525edb7)
Cc: stable@vger.kernel.org
2026-08-12 10:22:10 -04:00
David Rosca
8c9aebcdd9 drm/amdgpu: Reject UVD message with dimensions above 4096
Fixes potential overflow in DPB size calculations.

Signed-off-by: David Rosca <david.rosca@amd.com>
Acked-by: Leo Liu <leo.liu@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 05e1387d15)
Cc: stable@vger.kernel.org
2026-08-12 10:22:03 -04:00
Yang Wang
2a9c5154a5 drm/amdgpu: check ASPM on the dGPU host link
dGPUs with an internal PCIe switch expose graphics functions below the
switch downstream port. The automatic ASPM check uses the display
endpoint and evaluates the internal link instead of the host link.

Use the switch upstream port for the check and report the selected
link.

Fixes: 0ab5d711ec ("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device")
Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4e0d6f2876)
Cc: stable@vger.kernel.org
2026-08-12 10:21:31 -04:00
Guangshuo Li
587be7a173 drm/radeon: fix autosuspend cleanup during teardown
radeon_driver_load_kms() calls pm_runtime_use_autosuspend() for PX
devices, but radeon_driver_unload_kms() does not call the matching
pm_runtime_dont_use_autosuspend() during teardown.

If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during teardown, this reference is not dropped.

The documentation for pm_runtime_use_autosuspend() also notes that it
is important to undo it with pm_runtime_dont_use_autosuspend() at
driver exit time, unless runtime PM was initially enabled with
devm_pm_runtime_enable().

Add the missing pm_runtime_dont_use_autosuspend() call to the driver
unload path.

This issue was found by manual code inspection.

Fixes: 10ebc0bc09 ("drm/radeon: add runtime PM support (v2)")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 0fdc1ff82e)
Cc: stable@vger.kernel.org
2026-08-12 10:21:23 -04:00
Alex Deucher
47cd311850 drm/amdgpu: fix missing check in vm_flush()
We shouldn't return early if we need to emit spm update.

Reviewed-by: David Rosca <david.rosca@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 54a118f1d7)
Cc: stable@vger.kernel.org
2026-08-12 10:21:14 -04:00
Samuel Pitoiset
f2a1c4c6fe drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when
vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before
a stream is attached to it.

BUG: kernel NULL pointer dereference, address: 0000000000000008
RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu]
Call Trace:
 drm_vblank_enable
 drm_vblank_get
 drm_crtc_get_sequence_ioctl
 drm_ioctl_kernel
 drm_ioctl

Reproduced by running VKCTS with WSI tests enabled on RADV.

Guard the enable path on acrtc_state->stream being non-NULL, matching
the existing checks in this function.

Fixes: 34d66bc7ff ("drm/amd/display: Fix Xorg desktop unresponsive on Replay panel")
Reviewed-by: Melissa Wen <mwen@igalia.com>
Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 7b1b31bf69)
Cc: stable@vger.kernel.org
2026-08-12 10:21:06 -04:00
Candice Li
5e9d136ad7 drm/amdgpu: validate GEM_CREATE domain combinations
AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK,
but did not validate domain combinations. Userspace could combine
CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making
amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and
hit BUG_ON().

Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/
VRAM domains to be specified one at a time. Return -EINVAL for invalid
combinations in amdgpu_gem_create_ioctl().

v2: Rename helper from amdgpu_gem_domain_valid() to
    amdgpu_gem_are_domains_valid() (Christian)

Signed-off-by: Candice Li <candice.li@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit db39852d0c)
Cc: stable@vger.kernel.org
2026-08-12 10:20:58 -04:00
Junrui Luo
931cd1d1ba drm/amdgpu: disallow multiple FENCE chunks in one submit
amdgpu_cs_pass1() dispatches on chunk_id once per chunk without
rejecting repeated ids. p->uf_bo is a single-slot field, so a
submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs
amdgpu_cs_p1_user_fence() twice, and the second run overwrites
p->uf_bo with a freshly referenced BO without dropping the reference
taken by the first.

amdgpu_cs_parser_fini() only unrefs the final p->uf_bo, so every FENCE
chunk but the last leaks a BO reference. The leaked BO outlives handle
close and process exit.

Reject duplicate FENCE chunks the same way commit fec5f8e8c6
("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did
for p->bo_list.

Fixes: d38ceaf99e ("drm/amdgpu: add core driver (v4)")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 665b1fc2a1)
2026-08-12 10:20:50 -04:00
Tvrtko Ursulin
9a11db6887 drm/sched: Mark fair policy as experimental
Mark the fair policy as experimental until reported regressions are
addressed.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-20-tvrtko.ursulin@igalia.com
2026-08-11 17:34:13 +01:00
Tvrtko Ursulin
2bbea6b819 Revert "drm/sched: Switch default policy to fair"
This reverts commit 45c211ddf9.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-19-tvrtko.ursulin@igalia.com
2026-08-11 17:34:13 +01:00
Tvrtko Ursulin
9e9da86254 Revert "drm/sched: Remove FIFO and RR and simplify to a single run queue"
This reverts commit 77a6809f1d.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-18-tvrtko.ursulin@igalia.com
2026-08-11 17:34:10 +01:00
Tvrtko Ursulin
67cf83ac83 Revert "drm/sched: Embed run queue singleton into the scheduler"
This reverts commit 16e7698bc0.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-17-tvrtko.ursulin@igalia.com
2026-08-11 17:34:06 +01:00
Tvrtko Ursulin
4788c25fcd Revert "drm/amdgpu: Remove drm_sched_init_args->num_rqs usage"
This reverts commit 2462a0ce23.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-13-tvrtko.ursulin@igalia.com
2026-08-11 17:34:05 +01:00
Tvrtko Ursulin
4ce955c533 Revert "drm/etnaviv: Remove drm_sched_init_args->num_rqs usage"
This reverts commit adfb5deba5.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-12-tvrtko.ursulin@igalia.com
2026-08-11 17:34:04 +01:00
Tvrtko Ursulin
6c7b7e5120 Revert "drm/imagination: Remove drm_sched_init_args->num_rqs usage"
This reverts commit f84d73d2a0.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-11-tvrtko.ursulin@igalia.com
2026-08-11 17:34:04 +01:00
Tvrtko Ursulin
b9f3f3f00b Revert "drm/lima: Remove drm_sched_init_args->num_rqs usage"
This reverts commit 098fe077ec.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-10-tvrtko.ursulin@igalia.com
2026-08-11 17:34:03 +01:00
Tvrtko Ursulin
2683a0e7c4 Revert "drm/msm: Remove drm_sched_init_args->num_rqs usage"
This reverts commit 9c44ff0559.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-9-tvrtko.ursulin@igalia.com
2026-08-11 17:34:03 +01:00
Tvrtko Ursulin
5b07bcb103 Revert "drm/nouveau: Remove drm_sched_init_args->num_rqs usage"
This reverts commit 79005e34bd.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-8-tvrtko.ursulin@igalia.com
2026-08-11 17:34:02 +01:00
Tvrtko Ursulin
c9126bf8fc Revert "drm/panfrost: Remove drm_sched_init_args->num_rqs usage"
This reverts commit 285eab7f55.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-7-tvrtko.ursulin@igalia.com
2026-08-11 17:34:02 +01:00
Tvrtko Ursulin
09e6a5d433 Revert "drm/panthor: Remove drm_sched_init_args->num_rqs usage"
This reverts commit 30c4a19cf7.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-6-tvrtko.ursulin@igalia.com
2026-08-11 17:34:02 +01:00