Sanjay Yadav [Thu, 8 Jan 2026 11:32:29 +0000 (17:02 +0530)]
drm/buddy: Prevent BUG_ON by validating rounded allocation
When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is
rounded up to the next power-of-two via roundup_pow_of_two().
Similarly, for non-contiguous allocations with large min_block_size,
the size is aligned up via round_up(). Both operations can produce a
rounded size that exceeds mm->size, which later triggers
BUG_ON(order > mm->max_order).
Example scenarios:
- 9G CONTIGUOUS allocation on 10G VRAM memory:
roundup_pow_of_two(9G) = 16G > 10G
- 9G allocation with 8G min_block_size on 10G VRAM memory:
round_up(9G, 8G) = 16G > 10G
Fix this by checking the rounded size against mm->size. For
non-contiguous or range allocations where size > mm->size is invalid,
return -EINVAL immediately. For contiguous allocations without range
restrictions, allow the request to fall through to the existing
__alloc_contig_try_harder() fallback.
This ensures invalid user input returns an error or uses the fallback
path instead of hitting BUG_ON.
v2: (Matt A)
- Add Fixes, Cc stable, and Closes tags for context
drm/atmel-hlcdc: don't reject the commit if the src rect has fractional parts
Don’t reject the commit when the source rectangle has fractional parts.
This can occur due to scaling: drm_atomic_helper_check_plane_state() calls
drm_rect_clip_scaled(), which may introduce fractional parts while
computing the clipped source rectangle. This does not imply the commit is
invalid, so we should accept it instead of discarding it.
drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
the atmel_hlcdc_plane state structure without properly duplicating the
drm_plane_state. In particular, state->commit remained set to the old
state commit, which can lead to a use-after-free in the next
drm_atomic_commit() call.
Fix this by calling
__drm_atomic_helper_duplicate_plane_state(), which correctly clones
the base drm_plane_state (including the ->commit pointer).
It has been seen when closing and re-opening the device node while
another DRM client (e.g. fbdev) is still attached:
drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
After several commits, the slab memory increases. Some drm_crtc_commit
objects are not freed. The atomic_destroy_state callback only put the
framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function
to put all the objects that are no longer needed.
It has been seen after hours of usage of a graphics application or using
kmemleak:
Luca Ceresoli [Fri, 9 Jan 2026 07:31:43 +0000 (08:31 +0100)]
drm/bridge: samsung-dsim: samsung_dsim_host_attach: convert to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done. Also switch to the drm_bridge::next_bridge pointer.
This needs to handle both cases: when of_drm_find_panel() succeeds and when
it fails.
In the 'else' case (i.e. when of_drm_find_panel() fails), just switch to
of_drm_find_and_get_bridge() to ensure the bridge is not freed while in use
in the function tail, when it is stored in dsi->bridge.next_bridge.
In the 'then' case (i.e. when of_drm_find_panel() succeeds),
devm_drm_panel_bridge_add() already increments the refcount using devres
which ties the bridge allocation lifetime to the device lifetime, so we
would not need to do anything. However to have the same behaviour in both
branches take an additional reference here, so that the bridge needs to be
put whichever branch is taken without more complicated logic. Ensure to
clear the bridge pointer however, to avoid calling drm_bridge_put() on an
ERR_PTR.
Luca Ceresoli [Fri, 9 Jan 2026 07:31:42 +0000 (08:31 +0100)]
drm/bridge: samsung-dsim: samsung_dsim_host_attach: don't use the bridge pointer as an error indicator
In preparation to handle refcounting of the out_bridge, we need to ensure
the out_bridge pointer contains either a valid bridge pointer or NULL, not
an ERR_PTR. Otherwise calls such as drm_bridge_get/put() would try to
redeference an ERR_PTR.
Stop using IS_ERR(next_bridge) as an indication of an error, and instead
use the 'ret' integer.
Luca Ceresoli [Fri, 9 Jan 2026 07:31:41 +0000 (08:31 +0100)]
drm/bridge: samsung-dsim: samsung_dsim_host_attach: use a temporary variable for the next bridge
In preparation to handle refcounting of the out_bridge, we need to ensure
the out_bridge pointer contains either a valid bridge pointer or NULL, not
an ERR_PTR. Otherwise calls such as drm_bridge_get/put() would try to
redeference an ERR_PTR.
As a preliminary cleanup, add a temporary local 'next_bridge' pointer and
only copy it in dsi->out_bridge as late as possible, i.e. just before
calling pdata->host_ops->attach() which uses it (only in the exynos
driver).
Not strictly needed, but for symmetry move the clearing of dsi->out_bridge
in samsung_dsim_host_detach() to after pdata->host_ops->detach().
Luca Ceresoli [Fri, 9 Jan 2026 07:31:40 +0000 (08:31 +0100)]
drm/bridge: imx8qxp-ldb: convert to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done.
Since the companion bridge pointer is used by many bridge funcs, putting
its reference in the remove function would be dangerous. Use .destroy to
put it on final deallocation.
Luca Ceresoli [Fri, 9 Jan 2026 07:31:39 +0000 (08:31 +0100)]
drm/bridge: imx8mp-hdmi-pvi: convert to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done by using the drm_bridge::next_bridge pointer.
Luca Ceresoli [Fri, 9 Jan 2026 07:31:38 +0000 (08:31 +0100)]
drm/bridge: lt8912b: convert to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done by using the drm_bridge::next_bridge pointer.
Luca Ceresoli [Fri, 9 Jan 2026 07:31:37 +0000 (08:31 +0100)]
drm/bridge: tpd12s015: convert to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done by using the drm_bridge::next_bridge pointer.
Luca Ceresoli [Fri, 9 Jan 2026 07:31:36 +0000 (08:31 +0100)]
drm/bridge: tfp410: convert to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done by using the drm_bridge::next_bridge pointer.
Luca Ceresoli [Fri, 9 Jan 2026 07:31:35 +0000 (08:31 +0100)]
drm/bridge: thc63lvd1024: convert to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done by using the drm_bridge::next_bridge pointer.
Luca Ceresoli [Fri, 9 Jan 2026 07:31:34 +0000 (08:31 +0100)]
drm/bridge: sii902x: convert to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done by using the drm_bridge::next_bridge pointer.
Luca Ceresoli [Fri, 9 Jan 2026 07:31:33 +0000 (08:31 +0100)]
drm: of: drm_of_panel_bridge_remove(): convert to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put when done.
drm/atmel-hlcdc: destroy properly the plane state in the reset callback
If there is a plane state to destroy when doing a plane reset, destroy
it using the atmel_hlcdc_plane_destroy_state() function. So we call
__drm_atomic_helper_plane_destroy_state() and avoid code duplication.
Chris Morgan [Tue, 13 Jan 2026 19:57:18 +0000 (13:57 -0600)]
drm/panel: jd9365da: Support for Anbernic RG-DS Panel
Add support for both panels used in the Anbernic RG-DS. These panels
are physically identical and differ only with a single instruction
in the init sequence. The init sequence commands suggest it uses
an identical controller as the jd9365da.
Additionally, allow specifying per-panel dsi->mode_flags that can
override the default values.
Co-developed-by: Alexander Weinzerl <aweinzerl13@yahoo.com> Signed-off-by: Alexander Weinzerl <aweinzerl13@yahoo.com> Signed-off-by: Chris Morgan <macromorgan@hotmail.com> Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20260113195721.151205-4-macroalpha82@gmail.com
Chris Morgan [Tue, 13 Jan 2026 19:57:17 +0000 (13:57 -0600)]
dt-bindings: display: panel: Add compatible for Anbernic RG-DS
The Anbernic RG-DS uses two (mostly) identical panels as a top
and bottom panel which appear to use the same controller as the
Jadard JD9365DA-H3. The panels differ with a parameter defined
differently in the init sequence.
Chris Morgan [Tue, 13 Jan 2026 19:57:16 +0000 (13:57 -0600)]
drm: panel: jd9365da: Use gpiod_set_value_cansleep()
Change instances of gpiod_set_value() to gpiod_set_value_cansleep().
Uses of gpiod_set_value() generates warnings when used in instances
where desc->gdev->can_sleep is true.
Andy Yan [Sat, 17 Jan 2026 02:07:30 +0000 (10:07 +0800)]
drm/rockchip: vop2: Add mode valid callback for crtc
The different Video Ports support different maximum resolutions.
Reject resolutions that are not supported by a specific VP.
Only the output width is checked because the hardware itself does
not have a hard output height limit.
Filter the mode that can't output by the VP/crtc.
Signed-off-by: Andy Yan <andy.yan@rock-chips.com> Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Tested-by: Sebastian Reichel <sebastian.reichel@collabora.com> # Sige5 Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20260117020738.294825-1-andyshrk@163.com
The threaded interrupt handler on RK3588 checks HPD IRQ status before
deciding to continue with interrupt clearing and unmasking. However,
this is not really necessary, since the hard interrupt handler already
performs the very same verification before waking the handler thread.
Get rid of the redundant verification of the HPD interrupt status in the
threaded interrupt handler.
The threaded interrupt handler on RK3576 checks HPD IRQ status before
deciding to continue with interrupt clearing and unmasking.
This is not only redundant, since a similar verification has been
already performed by the hard IRQ handler before masking the interrupt,
but is also error prone, because it might happen that hardware clears
the status register right after the masking operation completes, and
before the threaded handler reads its value.
The consequence is that HPD IRQ gets never unmasked, which breaks
hotplug detection until reloading the driver or rebooting the system.
Drop the unnecessary verification of the HPD interrupt status from the
threaded interrupt handler.
Dmitry Baryshkov [Mon, 19 Jan 2026 20:08:09 +0000 (22:08 +0200)]
drm/tests: hdmi: fix build failure
The commit ca59e33f5a1f ("drm/atomic: add max_size check to
drm_property_replace_blob_from_id()") added a new parameter to
drm_property_replace_blob_from_id(), however commit 7436a87db99d
("drm/tests: hdmi: check the infoframes behaviour") was based on the
older tree and used the old number of params (with me failing to run
kunit tests when applying).
Fix the build error by specifying -1 as the max_size (as expected).
Baihan Li [Wed, 10 Dec 2025 02:37:59 +0000 (10:37 +0800)]
drm/hisilicon/hibmc: Adding reset colorbar cfg in dp init.
Add colorbar disable operation before reset chontroller, to make sure
colorbar status is clear in the DP init, so if rmmod the driver and the
previous colorbar configuration will not affect the next time insmod the
driver.
Fixes: 3c7623fb5bb6 ("drm/hisilicon/hibmc: Enable this hot plug detect of irq feature") Signed-off-by: Baihan Li <libaihan@huawei.com> Signed-off-by: Yongbang Shi <shiyongbang@huawei.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Tao Tian <tiantao6@hisilicon.com> Link: https://patch.msgid.link/20251210023759.3944834-5-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Baihan Li [Wed, 10 Dec 2025 02:37:58 +0000 (10:37 +0800)]
drm/hisilicon/hibmc: fix no showing problem with loading hibmc manually
When using command rmmod and insmod, there is no showing in second time
insmoding. Because DP controller won't send HPD signals, if connection
doesn't change or controller isn't reset. So add reset before unreset
in hibmc_dp_hw_init().
And also need to move the HDCP cfg after DP controller de-resets, so
that HDCP configuration takes effect.
Fixes: 3c7623fb5bb6 ("drm/hisilicon/hibmc: Enable this hot plug detect of irq feature") Signed-off-by: Baihan Li <libaihan@huawei.com> Signed-off-by: Yongbang Shi <shiyongbang@huawei.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Tao Tian <tiantao6@hisilicon.com> Link: https://patch.msgid.link/20251210023759.3944834-4-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Baihan Li [Wed, 10 Dec 2025 02:37:56 +0000 (10:37 +0800)]
drm/hisilicon/hibmc: fix dp probabilistical detect errors after HPD irq
The issue is that drm_connector_helper_detect_from_ddc() returns wrong
status when plugging or unplugging the monitor, which may cause the link
failed err.[0] Use HPD pin status in DP's detect_ctx() for real physical
monitor in/out, and implement a complete DP detection including read DPCD,
check if it's a branch device and its sink count for different situations.
[0]:
hibme-drm 0000:83:00.0: [drm] *ERROR* channel equalization failed 5 times
hibme-drm 0000:83:00.0: [drm] *ERROR* channel equalization failed 5 times
hibme-drm 0000:83:00.0: [drm] *ERROR* dp link training failed, ret: -16
hibmc-drm 0000:83:00.0: [drm] *ERROR* hibme dp mode set failed: -16
Fixes: 3c7623fb5bb6 ("drm/hisilicon/hibmc: Enable this hot plug detect of irq feature") Signed-off-by: Baihan Li <libaihan@huawei.com> Signed-off-by: Yongbang Shi <shiyongbang@huawei.com> Reviewed-by: Tao Tian <tiantao6@hisilicon.com> Link: https://patch.msgid.link/20251210023759.3944834-2-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Michał Grzelak [Mon, 8 Dec 2025 10:27:14 +0000 (11:27 +0100)]
drm/buddy: release free_trees array on buddy mm teardown
During initialization of DRM buddy memory manager at drm_buddy_init,
mm->free_trees array is allocated for both clear and dirty RB trees.
During cleanup happening at drm_buddy_fini it is never freed, leading to
following memory leaks observed on xe module load & unload cycles:
Deallocate array for free trees when cleaning up buddy memory manager
in the same way as if going through out_free_tree label.
Fixes: d4cd665c98c1 ("drm/buddy: Separate clear and dirty free block trees") Signed-off-by: Michał Grzelak <michal.grzelak@intel.com> Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com> Link: https://patch.msgid.link/20251208102714.4008260-2-michal.grzelak@intel.com
T.J. Mercier [Fri, 16 Jan 2026 19:05:12 +0000 (11:05 -0800)]
dma-buf: Remove DMA-BUF sysfs stats
Commit bdb8d06dfefd ("dmabuf: Add the capability to expose DMA-BUF stats
in sysfs") added dmabuf statistics to sysfs in 2021 under
CONFIG_DMABUF_SYSFS_STATS. After being used in production, performance
problems were discovered leading to its deprecation in 2022 in commit e0a9f1fe206a ("dma-buf: deprecate DMABUF_SYSFS_STATS"). Some of the
problems with this interface were discussed in my LPC 2025 talk. [1][2]
Android was probably the last user of the interface, which has since
been migrated to use the dmabuf BPF iterator [3] to obtain the same
information more cheaply. As promised in that series, now that the
longterm stable 6.18 kernel has been released let's remove the sysfs
dmabuf statistics from the kernel.
Eric Chanudet [Fri, 16 Jan 2026 20:05:39 +0000 (15:05 -0500)]
dma-buf: system_heap: account for system heap allocation in memcg
The system dma-buf heap lets userspace allocate buffers from the page
allocator. However, these allocations are not accounted for in memcg,
allowing processes to escape limits that may be configured.
Pass __GFP_ACCOUNT for system heap allocations, based on the
dma_heap.mem_accounting parameter, to use memcg and account for them.
Eric Chanudet [Fri, 16 Jan 2026 20:05:38 +0000 (15:05 -0500)]
dma-buf: heaps: add parameter to account allocations using cgroup
Add a parameter to enable dma-buf heaps allocation accounting using
cgroup for heaps that implement it. It is disabled by default as doing
so incurs caveats based on how memcg currently accounts for shared
buffers.
Signed-off-by: Eric Chanudet <echanude@redhat.com> Reviewed-by: T.J. Mercier <tjmercier@google.com> Reviewed-by: Christian König <christian.koenig@amd.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org> Link: https://patch.msgid.link/20260116-dmabuf-heap-system-memcg-v3-1-ecc6b62cc446@redhat.com
Alexandru Dadu [Tue, 13 Jan 2026 10:16:42 +0000 (10:16 +0000)]
drm/imagination: Add gpuid module parameter
The "gpuid" module parameter is used to override the gpuid read from a
hardware register and is useful for testing the loading of different
firmware (including processing of the firmware header) without having
the hardware to hand.
Matt Coster [Tue, 13 Jan 2026 10:16:41 +0000 (10:16 +0000)]
drm/imagination: Load FW trace config at init
We have a module parameter to set the initial group mask before debugfs is
available for any specific device, but don't currently use that value when
initialising devices.
Use the module parameter value as the initial value for group_mask.
Matt Coster [Tue, 13 Jan 2026 10:16:40 +0000 (10:16 +0000)]
drm/imagination: Validate fw trace group_mask
This value can come from two places: a module parameter or a debugfs file.
In both cases, validate it early to provide feedback to userspace at the
time the value is set instead of deferring until the value is used.
Matt Coster [Tue, 13 Jan 2026 10:16:39 +0000 (10:16 +0000)]
drm/imagination: Simplify module parameters
We had a whole load of bloaty infrastructure to deal with module parameters
in a way that's wholly unnecessary. Strip it all back to basics to make
adding new parameters less of a headache.
The rest of the DRM framework uses presence of the callbacks to check if
the particular infoframe is supported. Register HDMI callbacks
dynamically, basing on the corresponding drm_bridge ops.
There is little point in generating InfoFrames which are not supported
by the driver. Skip generating the unsupported InfoFrames, making sure
that the kernel never tries to write the unsupported frame. As there are
no remaining usecases, change write_infoframe / clear_infoframe helpers
return an error if the corresponding callback is NULL.
drm/display: hdmi_state_helper: reject Audio IF updates if it's not supported
Updating the InfoFrame if it can not be sent over the wire makes no
sense. Change drm_atomic_helper_connector_hdmi_update_audio_infoframe()
and drm_atomic_helper_connector_hdmi_clear_audio_infoframe() to return
an error if Audio InfoFrame callbacks are not implemented.
drm/display: hdmi_state_helper: split InfoFrame functions per type
Havign a single set of InfoFrame callbacks doesn't provide enough
information to the DRM framework about the InfoFrame types that are
actually supported. Also it's not really future-proof: it provides a way
to program only a single Vendor-Specific frame, however we might need to
support multiple VSIs at the same time (e.g. HDMI vs HDMI Forum
VSIs).
Provide separate sets of callbacks, one per the InfoFrame type.
Having only a single set of callbacks, hdmi_clear_infoframe and
hdmi_write_infoframe, bridge drivers don't have an easy way to signal to
the DRM framework, which InfoFrames are actually supported by the
hardware and by the driver and which are not. Also, it makes it
extremely easy for HDMI bridge drivers to skip implementing the
seemingly required InfoFrames (e.g. HDMI VSI). Last, but not least,
those callbacks take a single 'type' parameter, which makes it
impossible to implement support for multiple VSIs (which will be
required once we start working on HDMI Forum VSI).
Split the callbacks into a per-InfoFrame-kind pairs, letting the bridge
drivers actually signal supported features. The implementation follows
the overall drm_bridge design, where the bridge has a single
drm_bridge_funcs implementation and signals, which functions are to be
called using the drm_bridge->ops flags.
The AVI and HDMI VSI are assumed to be required for a normal HDMI
operation (with the drivers getting a drm_warn_once() stub
implementation if one is missing). The Audio InfoFrame is handled by the
existing DRM_BRIDGE_OP_HDMI_AUDIO, while the SPD and HDR DRM InfoFrames
got new drm_bridge_ops values.
drm/connector: make clear_infoframe callback mandatory for HDMI connectors
We already require both hdmi_write_infoframe and hdmi_clear_infoframe
for bridges implementing DRM_BRIDGE_OP_HDMI. It makes sense to require
the clear_infoframes callback for HDMI connectors utilizing
drmm_connector_hdmi_init().
Verify the InfoFrames behaviour. Check that reporting InfoFrame as
unsupported doesn't result in a commit error. Also check that HDR and
Audio InfoFrames are not triggered if corresponding features are not
enabled.
Maíra Canal [Mon, 12 Jan 2026 11:51:37 +0000 (08:51 -0300)]
drm/v3d: Convert v3d logging to device-based DRM helpers
Replace legacy DRM_DEBUG/INFO/WARN/ERROR logging with the corresponding
device-based drm_dbg(), drm_info(), drm_warn() and drm_err() helpers.
For some messages, adjust the log level to better reflect their severity.
This allows filtering via drm.debug, reduces log spam, and helps
differentiate v3d logs from vc4 logs.
Maíra Canal [Mon, 12 Jan 2026 11:51:36 +0000 (08:51 -0300)]
drm/v3d: Consolidate CPU job validation in a function
All CPU job extension parsers duplicate the same validation procedure:
ensure the extension is attached to a CPU job (not a GPU job) and that
only a single CPU job extension is associated with a given job.
Create a function to consolidate these checks and reduce the boilerplate
across the various CPU job extension handlers. While here, convert the
legacy DRM_DEBUG with a more appropriate drm_dbg().
Xiao Kan [Wed, 14 Jan 2026 13:22:26 +0000 (08:22 -0500)]
drm: Account property blob allocations to memcg
DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
property blobs backed by kernel memory.
Currently, the blob data allocation is not accounted to the allocating
process's memory cgroup, allowing unprivileged users to trigger unbounded
kernel memory consumption and potentially cause system-wide OOM.
Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
is properly charged to the caller's memcg. This ensures existing cgroup
memory limits apply and prevents uncontrolled kernel memory growth without
introducing additional policy or per-file limits.
This happens for panels that need to send MIPI-DSI commands in their
unprepare() callback. Since the MIPI-DSI interface is stopped at that
point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.
Fix by moving rzg2l_mipi_dsi_stop() to new callback function
rzg2l_mipi_dsi_atomic_post_disable().
With this change we now have the correct power-down/stop sequence:
Suggested-by: Biju Das <biju.das.jz@bp.renesas.com> Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com> Tested-by: Biju Das <biju.das.jz@bp.renesas.com> Link: https://patch.msgid.link/20260112154333.655352-1-hugo@hugovil.com Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
drm/rockchip: DRM_ROCKCHIP should depend on ARCH_ROCKCHIP
Rockchip display hardware is only available on Rockchip SoCs. Hence add
a dependency on ARCH_ROCKCHIP, to prevent asking the user about this
driver when configuring a kernel without Rockchip platform support.
Before, this dependency was implicit through a hard dependency on
ROCKCHIP_IOMMU.
drm/atomic: verify that gamma/degamma LUTs are not too big
The kernel specifies LUT table sizes in a separate property, however it
doesn't enforce it as a maximum. Some drivers implement max size check
on their own in the atomic_check path. Other drivers simply ignore the
issue. Perform LUT size validation in the generic place.
drm/atomic: add max_size check to drm_property_replace_blob_from_id()
The function drm_property_replace_blob_from_id() allows checking whether
the blob size is equal to a predefined value. In case of variable-size
properties (like the gamma / degamma LUTs) we might want to check for
the blob size against the maximum, allowing properties of the size
lesser than the max supported by the hardware. Extend the function in
order to support such checks.
We have a helper to get property values for non-atomic drivers and
another one default property values for atomic drivers. In some cases we
need the ability to get value of immutable property, no matter what kind
of driver it is. Implement new property-related helper,
drm_object_immutable_property_get_value(), which lets the caller to get
the value of the immutable property.
drm/panthor: Implement reading shader_present from nvmem
On some platforms, notably MediaTek MT8196, the shader_present bitmask
in the Mali GPU register for it has cores enabled that may be faulty.
The true shader_present bitmask is found in an efuse instead.
Implement reading shader_present from an nvmem cell if one is present,
falling back to the Mali register if it's absent. The error codes are
trickled up through to the probe function so that probe deferral works.
On the MediaTek MT8196 SoC, the bitmask for which shader cores are
present and functional is not the one in the Mali GPU's registers, but
in an external efuse.
Add the nvmem cell properties to describe such a setup, and make them
required on MT8196.
Uwe Kleine-König [Wed, 10 Dec 2025 08:31:38 +0000 (09:31 +0100)]
host1x: Convert to bus methods
The callbacks .probe(), .remove() and .shutdown() for device_drivers
should go away. So migrate to bus methods. There are two differences
that need addressing:
- The bus remove callback returns void while the driver remove callback
returns int (the actual value is ignored by the core).
- The bus shutdown callback is also called for unbound devices, so an
additional check for dev->driver != NULL is needed.
Uwe Kleine-König [Wed, 10 Dec 2025 08:31:37 +0000 (09:31 +0100)]
host1x: Make remove callback return void
The return value of struct device_driver::remove is ignored by the core
(see device_remove() in drivers/base/dd.c). So it doesn't make sense to
let the host1x remove callback return an int just to ignore it later.
So make the callback return void. All current implementors return 0, so
they are easily converted.
According to the sequence from section 7.3.4 of FT8006P datasheet,
TP_RSTN and RESX should be asserted after disabling AVDD and AVEE and
together with VDDI.
Also, AVEE power down needs to happen at least 150ms after entering
sleep mode.
drm/panel: mantix: Improve power on sequence timings
FP8006P datasheet mentions:
> It is necessary to wait 15msec after releasing RESX before sending
> commands. Also Sleep Out command cannot be sent for 120 msec.
This hasn't been respected by the driver so far, which could interfere
with the LCD init code sequence performed by the controller. In some cases
this leads to VCOM voltage being set to a wrong value, causing "halo"
effects, temporary burn-in around the edges of the screen and degraded
image contrast.
T3 and T4 are counted from when VDDI is enabled. There's no need to add
them when we've already waited more than that in T2 and T2d.
While FT8006P datasheet does not mention a delay between exiting sleep
mode and turning the display on, code provided by the vendor uses 120ms
there and it happens to be the same value as required in newer datasheets
for newer controllers from the same family, so it seems appropriate to
use it here as well.
Warning: include/uapi/drm/rocket_accel.h:35 Incorrect use of kernel-doc
format: * Output: DMA address for the BO in the NPU address space.
This address
and 22 warnings like these:
Warning: include/uapi/drm/rocket_accel.h:43 struct member 'size'
not described in 'drm_rocket_create_bo'
Warning: include/uapi/drm/rocket_accel.h:60 struct member 'handle'
not described in 'drm_rocket_prep_bo'
Warning: include/uapi/drm/rocket_accel.h:73 struct member 'handle'
not described in 'drm_rocket_fini_bo'
Warning: include/uapi/drm/rocket_accel.h:86 struct member 'regcmd'
not described in 'drm_rocket_task'
Warning: include/uapi/drm/rocket_accel.h:116 struct member 'tasks'
not described in 'drm_rocket_job'
Warning: include/uapi/drm/rocket_accel.h:135 struct member 'jobs'
not described in 'drm_rocket_submit'
Quentin Schulz [Mon, 15 Dec 2025 17:07:56 +0000 (18:07 +0100)]
accel/rocket: factor out code with find_core_for_dev in rocket_remove
There already is a function to return the offset of the core for a given
struct device, so let's reuse that function instead of reimplementing
the same logic.
There's one change in behavior when a struct device is passed which
doesn't match any core's. Before, we would continue through
rocket_remove() but now we exit early, to match what other callers of
find_core_for_dev() (rocket_device_runtime_resume/suspend()) are doing.
This however should never happen. Aside from that, no intended change in
behavior.
Quentin Schulz [Mon, 15 Dec 2025 16:36:15 +0000 (17:36 +0100)]
accel/rocket: fix unwinding in error path in rocket_probe
When rocket_core_init() fails (as could be the case with EPROBE_DEFER),
we need to properly unwind by decrementing the counter we just
incremented and if this is the first core we failed to probe, remove the
rocket DRM device with rocket_device_fini() as well. This matches the
logic in rocket_remove(). Failing to properly unwind results in
out-of-bounds accesses.
Quentin Schulz [Mon, 15 Dec 2025 16:36:14 +0000 (17:36 +0100)]
accel/rocket: fix unwinding in error path in rocket_core_init
When rocket_job_init() is called, iommu_group_get() has already been
called, therefore we should call iommu_group_put() and make the
iommu_group pointer NULL. This aligns with what's done in
rocket_core_fini().
If pm_runtime_resume_and_get() somehow fails, not only should
rocket_job_fini() be called but we should also unwind everything done
before that, that is, disable PM, put the iommu_group, NULLify it and
then call rocket_job_fini(). This is exactly what's done in
rocket_core_fini() so let's call that function instead of duplicating
the code.
Chris Morgan [Wed, 19 Nov 2025 22:55:25 +0000 (16:55 -0600)]
drm/bridge: dw-hdmi-qp: Add support for missing HPD
Add support for the dw-hdmi-qp driver to handle devices with missing
HPD pins.
Since in this situation we are now polling for the EDID data via i2c
change the error message to a rate limited debug message when we are
unable to complete an i2c read, as a disconnected device would
otherwise fill dmesg with i2c read errors.
Chris Morgan [Wed, 19 Nov 2025 22:55:24 +0000 (16:55 -0600)]
dt-bindings: display: rockchip: Add no-hpd for dw-hdmi-qp controller
Add an attribute of "no-hpd" for the Rockchip dw-hdmi-qp controller.
This is used to describe implementations where the HPD pin is not
connected or used for other purposes, such as in the RK3588S based
Gameforce Ace which repurposed the GPIO for an additional face
button.
The "no-hpd" option was chosen to be consistent with other devices
which already define this parameter for broken or missing hpd
functionality.
Marco Crivellari [Fri, 31 Oct 2025 10:48:46 +0000 (11:48 +0100)]
drm/rockchip: replace use of system_wq with system_percpu_wq
Currently if a user enqueue a work item using schedule_delayed_work() the
used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
schedule_work() that is using system_wq and queue_work(), that makes use
again of WORK_CPU_UNBOUND.
This lack of consistency cannot be addressed without refactoring the API.
system_wq should be the per-cpu workqueue, yet in this name nothing makes
that clear, so replace system_wq with system_percpu_wq.
The old wq (system_wq) will be kept for a few release cycles.
Marco Crivellari [Fri, 31 Oct 2025 10:48:45 +0000 (11:48 +0100)]
drm/rockchip: replace use of system_unbound_wq with system_dfl_wq
Currently if a user enqueue a work item using schedule_delayed_work() the
used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
schedule_work() that is using system_wq and queue_work(), that makes use
again of WORK_CPU_UNBOUND.
This lack of consistency cannot be addressed without refactoring the API.
system_unbound_wq should be the default workqueue so as not to enforce
locality constraints for random work whenever it's not required.
Adding system_dfl_wq to encourage its use when unbound work should be used.
The old system_unbound_wq will be kept for a few release cycles.
Boris Brezillon [Thu, 8 Jan 2026 12:33:25 +0000 (13:33 +0100)]
drm/panfrost: Fix a page leak in panfrost_mmu_map_fault_addr() when THP is on
drm_gem_put_pages(), which we rely on for returning BO pages to shmem,
assume per-folio refcounting and not per-page. If we call
shmem_read_mapping_page() per-page, we break this assumption and leak
pages every time we get a huge page allocated.
v2:
- Rework the logic for() loop to better match the folio-granular
allocation scheme
Boris Brezillon [Tue, 6 Jan 2026 16:49:35 +0000 (17:49 +0100)]
drm/gem: Fix a GEM leak in drm_gem_get_unmapped_area()
drm_gem_object_lookup_at_offset() can return a valid object with
filp or filp->f_op->get_unmapped_area set to NULL. Make sure we still
release the ref we acquired on such objects.
Chaoyi Chen [Thu, 6 Nov 2025 02:06:31 +0000 (10:06 +0800)]
drm/rockchip: Drop ROCKCHIP_IOMMU depend for DRM_ROCKCHIP
On the RK3506 platform, there is no iommu hardware. And even on
platform that have iommu hardware, it should be possible to use
VOP without enabling iommu. In this case, a contiguous memory
space like CMA should be used.
So this patch removes the dependency on ROCKCHIP_IOMMU
with an 'optional-dependency'.
drm/panic: Fix expected string for QR_CODE in drm_panic_type_map
The help text of CONFIG_DRM_PANIC_SCREEN_QR_CODE documents the expected
value to CONFIG_DRM_PANIC_SCREEN as "qr_code" but drm_panic_type_map
checks for "qr". Adjust drm_panic_type_map and the module description to
match so that existing configurations do not stop working.
drm/panic: Ensure drm_panic_type is initialized to a valid value
If a user has set an invalid CONFIG_DRM_PANIC_SCREEN value (such as
"qr_code" without CONFIG_DRM_PANIC_SCREEN_QR_CODE=y due to missing or
incorrect Rust dependencies), there is a panic when accessing
/sys/module/drm/parameters/panic_screen:
[ 12.218375] BUG: unable to handle page fault for address: 0000000796dd8818
[ 12.219737] #PF: supervisor read access in kernel mode
...
[ 12.227167] RIP: 0010:drm_panic_type_get+0x1b/0x30
If drm_panic_type_set() does not find a valid drm_panic_type enumeration
in drm_panic_type_map based on the provided value, it does not change
drm_panic_type from the default -1 value, which is not a valid index for
accessing drm_panic_type_map in drm_panic_type_get(), resulting in the
crash.
Validate the value of CONFIG_DRM_PANIC_SCREEN at boot time via the
return value of drm_panic_type_set() in drm_panic_init() and explicitly
fall back to the default of "user" with a message to the user so that
they can adjust their configuration or fix missing dependencies.
[ 0.800697] Unsupported value for CONFIG_DRM_PANIC_SCREEN ('qr_code'), falling back to 'user'...
Chaoyi Chen [Thu, 6 Nov 2025 02:06:32 +0000 (10:06 +0800)]
drm/rockchip: vop: Add support for rk3506
The VOP on rk3506:
- Support 2 lane MIPI DSI interface, 1.5Gbps/lane.
- Support RGB interface.
- Max output resolution is 1280x1280@60fps.
- WIN1 layer support RGB888/ARGB8888/RGB565.
- Support Gamma LUT.
projects / thirdparty / kernel / linux.git / log
