drm/atomic: add max_size check to drm_property_replace_blob_from_id()
The function drm_property_replace_blob_from_id() allows checking whether
the blob size is equal to a predefined value. In case of variable-size
properties (like the gamma / degamma LUTs) we might want to check for
the blob size against the maximum, allowing properties of the size
lesser than the max supported by the hardware. Extend the function in
order to support such checks.
We have a helper to get property values for non-atomic drivers and
another one default property values for atomic drivers. In some cases we
need the ability to get value of immutable property, no matter what kind
of driver it is. Implement new property-related helper,
drm_object_immutable_property_get_value(), which lets the caller to get
the value of the immutable property.
drm/panthor: Implement reading shader_present from nvmem
On some platforms, notably MediaTek MT8196, the shader_present bitmask
in the Mali GPU register for it has cores enabled that may be faulty.
The true shader_present bitmask is found in an efuse instead.
Implement reading shader_present from an nvmem cell if one is present,
falling back to the Mali register if it's absent. The error codes are
trickled up through to the probe function so that probe deferral works.
On the MediaTek MT8196 SoC, the bitmask for which shader cores are
present and functional is not the one in the Mali GPU's registers, but
in an external efuse.
Add the nvmem cell properties to describe such a setup, and make them
required on MT8196.
Uwe Kleine-König [Wed, 10 Dec 2025 08:31:38 +0000 (09:31 +0100)]
host1x: Convert to bus methods
The callbacks .probe(), .remove() and .shutdown() for device_drivers
should go away. So migrate to bus methods. There are two differences
that need addressing:
- The bus remove callback returns void while the driver remove callback
returns int (the actual value is ignored by the core).
- The bus shutdown callback is also called for unbound devices, so an
additional check for dev->driver != NULL is needed.
Uwe Kleine-König [Wed, 10 Dec 2025 08:31:37 +0000 (09:31 +0100)]
host1x: Make remove callback return void
The return value of struct device_driver::remove is ignored by the core
(see device_remove() in drivers/base/dd.c). So it doesn't make sense to
let the host1x remove callback return an int just to ignore it later.
So make the callback return void. All current implementors return 0, so
they are easily converted.
According to the sequence from section 7.3.4 of FT8006P datasheet,
TP_RSTN and RESX should be asserted after disabling AVDD and AVEE and
together with VDDI.
Also, AVEE power down needs to happen at least 150ms after entering
sleep mode.
drm/panel: mantix: Improve power on sequence timings
FP8006P datasheet mentions:
> It is necessary to wait 15msec after releasing RESX before sending
> commands. Also Sleep Out command cannot be sent for 120 msec.
This hasn't been respected by the driver so far, which could interfere
with the LCD init code sequence performed by the controller. In some cases
this leads to VCOM voltage being set to a wrong value, causing "halo"
effects, temporary burn-in around the edges of the screen and degraded
image contrast.
T3 and T4 are counted from when VDDI is enabled. There's no need to add
them when we've already waited more than that in T2 and T2d.
While FT8006P datasheet does not mention a delay between exiting sleep
mode and turning the display on, code provided by the vendor uses 120ms
there and it happens to be the same value as required in newer datasheets
for newer controllers from the same family, so it seems appropriate to
use it here as well.
Warning: include/uapi/drm/rocket_accel.h:35 Incorrect use of kernel-doc
format: * Output: DMA address for the BO in the NPU address space.
This address
and 22 warnings like these:
Warning: include/uapi/drm/rocket_accel.h:43 struct member 'size'
not described in 'drm_rocket_create_bo'
Warning: include/uapi/drm/rocket_accel.h:60 struct member 'handle'
not described in 'drm_rocket_prep_bo'
Warning: include/uapi/drm/rocket_accel.h:73 struct member 'handle'
not described in 'drm_rocket_fini_bo'
Warning: include/uapi/drm/rocket_accel.h:86 struct member 'regcmd'
not described in 'drm_rocket_task'
Warning: include/uapi/drm/rocket_accel.h:116 struct member 'tasks'
not described in 'drm_rocket_job'
Warning: include/uapi/drm/rocket_accel.h:135 struct member 'jobs'
not described in 'drm_rocket_submit'
Quentin Schulz [Mon, 15 Dec 2025 17:07:56 +0000 (18:07 +0100)]
accel/rocket: factor out code with find_core_for_dev in rocket_remove
There already is a function to return the offset of the core for a given
struct device, so let's reuse that function instead of reimplementing
the same logic.
There's one change in behavior when a struct device is passed which
doesn't match any core's. Before, we would continue through
rocket_remove() but now we exit early, to match what other callers of
find_core_for_dev() (rocket_device_runtime_resume/suspend()) are doing.
This however should never happen. Aside from that, no intended change in
behavior.
Quentin Schulz [Mon, 15 Dec 2025 16:36:15 +0000 (17:36 +0100)]
accel/rocket: fix unwinding in error path in rocket_probe
When rocket_core_init() fails (as could be the case with EPROBE_DEFER),
we need to properly unwind by decrementing the counter we just
incremented and if this is the first core we failed to probe, remove the
rocket DRM device with rocket_device_fini() as well. This matches the
logic in rocket_remove(). Failing to properly unwind results in
out-of-bounds accesses.
Quentin Schulz [Mon, 15 Dec 2025 16:36:14 +0000 (17:36 +0100)]
accel/rocket: fix unwinding in error path in rocket_core_init
When rocket_job_init() is called, iommu_group_get() has already been
called, therefore we should call iommu_group_put() and make the
iommu_group pointer NULL. This aligns with what's done in
rocket_core_fini().
If pm_runtime_resume_and_get() somehow fails, not only should
rocket_job_fini() be called but we should also unwind everything done
before that, that is, disable PM, put the iommu_group, NULLify it and
then call rocket_job_fini(). This is exactly what's done in
rocket_core_fini() so let's call that function instead of duplicating
the code.
Chris Morgan [Wed, 19 Nov 2025 22:55:25 +0000 (16:55 -0600)]
drm/bridge: dw-hdmi-qp: Add support for missing HPD
Add support for the dw-hdmi-qp driver to handle devices with missing
HPD pins.
Since in this situation we are now polling for the EDID data via i2c
change the error message to a rate limited debug message when we are
unable to complete an i2c read, as a disconnected device would
otherwise fill dmesg with i2c read errors.
Chris Morgan [Wed, 19 Nov 2025 22:55:24 +0000 (16:55 -0600)]
dt-bindings: display: rockchip: Add no-hpd for dw-hdmi-qp controller
Add an attribute of "no-hpd" for the Rockchip dw-hdmi-qp controller.
This is used to describe implementations where the HPD pin is not
connected or used for other purposes, such as in the RK3588S based
Gameforce Ace which repurposed the GPIO for an additional face
button.
The "no-hpd" option was chosen to be consistent with other devices
which already define this parameter for broken or missing hpd
functionality.
Marco Crivellari [Fri, 31 Oct 2025 10:48:46 +0000 (11:48 +0100)]
drm/rockchip: replace use of system_wq with system_percpu_wq
Currently if a user enqueue a work item using schedule_delayed_work() the
used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
schedule_work() that is using system_wq and queue_work(), that makes use
again of WORK_CPU_UNBOUND.
This lack of consistency cannot be addressed without refactoring the API.
system_wq should be the per-cpu workqueue, yet in this name nothing makes
that clear, so replace system_wq with system_percpu_wq.
The old wq (system_wq) will be kept for a few release cycles.
Marco Crivellari [Fri, 31 Oct 2025 10:48:45 +0000 (11:48 +0100)]
drm/rockchip: replace use of system_unbound_wq with system_dfl_wq
Currently if a user enqueue a work item using schedule_delayed_work() the
used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use
WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to
schedule_work() that is using system_wq and queue_work(), that makes use
again of WORK_CPU_UNBOUND.
This lack of consistency cannot be addressed without refactoring the API.
system_unbound_wq should be the default workqueue so as not to enforce
locality constraints for random work whenever it's not required.
Adding system_dfl_wq to encourage its use when unbound work should be used.
The old system_unbound_wq will be kept for a few release cycles.
Boris Brezillon [Thu, 8 Jan 2026 12:33:25 +0000 (13:33 +0100)]
drm/panfrost: Fix a page leak in panfrost_mmu_map_fault_addr() when THP is on
drm_gem_put_pages(), which we rely on for returning BO pages to shmem,
assume per-folio refcounting and not per-page. If we call
shmem_read_mapping_page() per-page, we break this assumption and leak
pages every time we get a huge page allocated.
v2:
- Rework the logic for() loop to better match the folio-granular
allocation scheme
Boris Brezillon [Tue, 6 Jan 2026 16:49:35 +0000 (17:49 +0100)]
drm/gem: Fix a GEM leak in drm_gem_get_unmapped_area()
drm_gem_object_lookup_at_offset() can return a valid object with
filp or filp->f_op->get_unmapped_area set to NULL. Make sure we still
release the ref we acquired on such objects.
Chaoyi Chen [Thu, 6 Nov 2025 02:06:31 +0000 (10:06 +0800)]
drm/rockchip: Drop ROCKCHIP_IOMMU depend for DRM_ROCKCHIP
On the RK3506 platform, there is no iommu hardware. And even on
platform that have iommu hardware, it should be possible to use
VOP without enabling iommu. In this case, a contiguous memory
space like CMA should be used.
So this patch removes the dependency on ROCKCHIP_IOMMU
with an 'optional-dependency'.
drm/panic: Fix expected string for QR_CODE in drm_panic_type_map
The help text of CONFIG_DRM_PANIC_SCREEN_QR_CODE documents the expected
value to CONFIG_DRM_PANIC_SCREEN as "qr_code" but drm_panic_type_map
checks for "qr". Adjust drm_panic_type_map and the module description to
match so that existing configurations do not stop working.
drm/panic: Ensure drm_panic_type is initialized to a valid value
If a user has set an invalid CONFIG_DRM_PANIC_SCREEN value (such as
"qr_code" without CONFIG_DRM_PANIC_SCREEN_QR_CODE=y due to missing or
incorrect Rust dependencies), there is a panic when accessing
/sys/module/drm/parameters/panic_screen:
[ 12.218375] BUG: unable to handle page fault for address: 0000000796dd8818
[ 12.219737] #PF: supervisor read access in kernel mode
...
[ 12.227167] RIP: 0010:drm_panic_type_get+0x1b/0x30
If drm_panic_type_set() does not find a valid drm_panic_type enumeration
in drm_panic_type_map based on the provided value, it does not change
drm_panic_type from the default -1 value, which is not a valid index for
accessing drm_panic_type_map in drm_panic_type_get(), resulting in the
crash.
Validate the value of CONFIG_DRM_PANIC_SCREEN at boot time via the
return value of drm_panic_type_set() in drm_panic_init() and explicitly
fall back to the default of "user" with a message to the user so that
they can adjust their configuration or fix missing dependencies.
[ 0.800697] Unsupported value for CONFIG_DRM_PANIC_SCREEN ('qr_code'), falling back to 'user'...
Chaoyi Chen [Thu, 6 Nov 2025 02:06:32 +0000 (10:06 +0800)]
drm/rockchip: vop: Add support for rk3506
The VOP on rk3506:
- Support 2 lane MIPI DSI interface, 1.5Gbps/lane.
- Support RGB interface.
- Max output resolution is 1280x1280@60fps.
- WIN1 layer support RGB888/ARGB8888/RGB565.
- Support Gamma LUT.
Daniel Stone [Mon, 15 Dec 2025 14:09:21 +0000 (15:09 +0100)]
drm/rockchip: vop2: Enforce AFBC source alignment in plane_check
Planes can only source AFBC framebuffers at multiples of 4px wide on
RK3566/RK3568. Instead of clipping on all SoCs when the user asks for an
unaligned source rectangle, reject the configuration in the plane's
atomic check on RK3566/RK3568 only.
Daniel Stone [Mon, 15 Dec 2025 14:09:20 +0000 (15:09 +0100)]
drm/rockchip: vop2: Enforce scaling workaround in plane_check
It seems only cluster windows are capable of applying downscaling when
the source region has an odd width. Instead of applying a workaround
inside atomic_update, fail the plane check if this is requested.
Daniel Stone [Mon, 15 Dec 2025 14:09:18 +0000 (15:09 +0100)]
drm/rockchip: vop2: Switch impossible pos conditional to WARN_ON
We already clip the plane to the display bounds in atomic_check, and
ensure that it is sufficiently sized. Instead of trying to catch this
and adjust for it in atomic_update, just assert that atomic_check has
done its job.
The latest firmware requires the message DMA buffer to
- have a minimum size of 8K
- use a power-of-two size
- be aligned to the buffer size
- not cross 64M boundary
Update the buffer allocation logic to meet these requirements and support
the latest firmware.
Alice Ryhl [Thu, 8 Jan 2026 16:07:32 +0000 (16:07 +0000)]
drm/gpuvm: drm_gpuvm_bo_obtain() requires lock and staged mode
In commit 9ce4aef9a5b1 ("drm/gpuvm: take GEM lock inside
drm_gpuvm_bo_obtain_prealloc()") we update
drm_gpuvm_bo_obtain_prealloc() to take locks internally, which means
that it's only usable in immediate mode.
In this commit, we notice that drm_gpuvm_bo_obtain() requires you to use
staged mode. This means that we now have one variant of obtain for each
mode you might use gpuvm in.
To reflect this information, we add a warning about using it in
immediate mode, and to make the distinction clearer we rename the method
with a _locked() suffix so that it's clear that it requires the caller
to take the locks.
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20260108-gpuvm-rust-v2-2-dbd014005a0b@google.com
[ Slightly reword commit message to refer to commit 9ce4aef9a5b1
("drm/gpuvm: take GEM lock inside drm_gpuvm_bo_obtain_prealloc()").
- Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Karol Wachowski [Tue, 30 Dec 2025 14:21:16 +0000 (15:21 +0100)]
accel/ivpu: Implement warm boot flow for NPU6 and unify boot handling
Starting from NPU6, the driver can pass boot parameters address through
the AON retention register and toggle between cold/warm boot types using
the boot_type parameter, while setting the cold boot entry point in both
cases.
Refactor the existing cold/warm boot handling to be consistent with the
new NPU6 boot flow requirements and still maintain compatibility with
older boot flows.
This will allow firmware to remove support for legacy warm boot starting
from NPU6.
Fixes: 550f4dd2cedd ("accel/ivpu: Add support for Nova Lake's NPU") Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com> Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com> Signed-off-by: Maciej Falkowski <maciej.falkowski@linux.intel.com> Link: https://patch.msgid.link/20251230142116.540026-1-maciej.falkowski@linux.intel.com
Linus Walleij [Sun, 30 Nov 2025 10:54:48 +0000 (11:54 +0100)]
dma-buf: heaps: Clear CMA pages with clear_page()
clear_page() translates into memset(*p, 0, PAGE_SIZE) on some
architectures, but on the major architectures it will call
an optimized assembly snippet so use this instead of open
coding a memset().
Gert Wollny [Wed, 19 Nov 2025 16:45:51 +0000 (17:45 +0100)]
drm/etnaviv: Add module parameter to force PPU flop reset
v2: Check for feature PIPE_3D when forcing PPU flop reset (Lucas)
v3: - drop use of ppu_flop_reset enum (Christian Gmeiner)
- don't initialize module parameter to zero (checkpatch)
- avoid multi-line string in warning message (checkpatch)
Signed-off-by: Gert Wollny <gert.wollny@collabora.com> Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com> Tested-by: Marek Vasut <marek.vasut@mailbox.org> # STM32MP255C DHCOS DHSBC Link: https://patch.msgid.link/20251119164624.9297-6-gert.wollny@collabora.com Signed-off-by: Christian Gmeiner <cgmeiner@igalia.com>
Gert Wollny [Wed, 19 Nov 2025 16:45:50 +0000 (17:45 +0100)]
drm/etnaviv: Add PPU flop reset
The PPU flop reset is required on some hardware to clear the
temporary registers. This code follows the implementation
of the PPU flop reset as found in the public galcore kernel
module. Compared to that code some superfluous parts were
removed and only the code path for SoC chip_model = 0x8000
and revision = 0x6205 is implemented and tested.
v2: - Move flop reset data to etnaviv_drm_private and initialize it
from etnaviv_gpu_bind (Lucas)
- Prepare code for more chip IDs and other flop reset types
- Do some cleanups and rename some functions
v3: - Move initialization of flop reset data to etnaviv_gpu_init (Lucas)
- Free PPU data suballocation (Lucas)
v4: As suggested by
- replace "asm-generic/int-ll64.h" with "linux/types.h"
- drop flop reset type enum since we only support one type here
- move function return parameters on same line with function name
- replace open coded for loop with memset32
- add cnost to local static values
- add a return value to etnaviv_flop_reset_ppu_init; handle and
pass errors on to the caller
- handle etnaviv_flop_reset_ppu_init return value
- use dev_err for flop reset error message
- fix include guard to be consistent with the other driver code
- fix license header and formatting
v5: As suggested by Christian Gmeiner:
- add required header that is no longer pulled in by etnaviv_buffer.h
- fix include style of linux headers
- free flop_reset_data_ppu when command buffer initialization fails
- fix typo in error message
[cgmeiner: fix SPDX comment style, fix line end with a '(' and fix typo]
Signed-off-by: Gert Wollny <gert.wollny@collabora.com> Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com> Tested-by: Marek Vasut <marek.vasut@mailbox.org> # STM32MP255C DHCOS DHSBC Link: https://patch.msgid.link/20251119164624.9297-5-gert.wollny@collabora.com Signed-off-by: Christian Gmeiner <cgmeiner@igalia.com>
drm/meson: venc: add support for HDMI DMT modes up to 3840x2160
Commit 5d0bfe448481 ("drm/meson: Add HDMI 1.4 4k modes") added support
for HDMI 1.4 4k modes, which is what TVs need. For computer monitors
the code is using the DMT code-path, which ends up in
meson_venc_hdmi_supported_mode(), which does not allow the 4k modes yet.
The datasheet for all supported SoCs mentions "4Kx2K@60". It's not
clear whether "4K" here means 3840 or 4096 pixels.
Allow resolutions up to 3840x2160 pixels (including middle steps, such
as WQHD at 2560x1440 pixels) so they can be used with computer monitors
(using the DMT code-path in the driver).
Jocelyn Falempe [Tue, 16 Dec 2025 08:20:38 +0000 (09:20 +0100)]
drm/panic: Rename draw_panic_static_* to draw_panic_screen_*
I called them "static" because the panic screen is drawn only once,
but this can be confused with the static meaning in C.
Also remove some unnecessary braces in draw_panic_dispatch().
No functionnal change.
Arnd Bergmann [Tue, 23 Dec 2025 21:49:09 +0000 (22:49 +0100)]
drm: pl111: fix build regression
The drm_info() function requires the drm/drm_print.h header to be included
first:
In file included from drivers/gpu/drm/pl111/pl111_nomadik.c:7:
drivers/gpu/drm/pl111/pl111_nomadik.h:11:32: error: 'struct drm_device' declared inside parameter list will not be visible outside of this definition or declaration [-Werror]
11 | void pl111_nomadik_init(struct drm_device *dev);
| ^~~~~~~~~~
drivers/gpu/drm/pl111/pl111_nomadik.c: In function 'pl111_nomadik_init':
drivers/gpu/drm/pl111/pl111_nomadik.c:34:9: error: implicit declaration of function 'drm_info'; did you mean 'pr_info'? [-Wimplicit-function-declaration]
34 | drm_info(dev, "set Nomadik PMU mux to CLCD mode\n");
| ^~~~~~~~
| pr_info
Xiaolei Wang [Wed, 3 Dec 2025 13:03:23 +0000 (21:03 +0800)]
drm/v3d: Set DMA segment size to avoid debug warnings
When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the
kernel occasionally reports a segment size mismatch. This is because
'max_seg_size' is not set. The kernel defaults to 64K. setting
'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'
from complaining about the over-mapping of the V3D segment length.
imx8qxp_pixel_link_find_next_bridge() already emits a DRM_DEV_ERROR() on
error except for -EPROBE_DEFER. The caller emits another one, which is
redundant. Remove the message in the caller and keep the one in
imx8qxp_pixel_link_find_next_bridge() as it is more informative about the
error cause.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:50 +0000 (18:58 +0100)]
drm/bridge: imx8qxp-pxl2dpi: get/put the companion bridge
This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
function and stores it until driver removal. of_drm_find_bridge() is
deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
refcounted and use the destroy hook to put the reference on deallocation.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:49 +0000 (18:58 +0100)]
drm/bridge: imx8qxp-pxl2dpi: get/put the next bridge
This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
function and stores it until driver removal. of_drm_find_bridge() is
deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
refcounted and use bridge->next_bridge to put the reference on
deallocation.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:48 +0000 (18:58 +0100)]
drm/bridge: imx8qxp-pxl2dpi: imx8qxp_pxl2dpi_find_next_bridge: return int, not ERR_PTR
In preparation for using bridge->next_bridge, we need to ensure that it
will never contain anything but NULL or a valid bridge pointer. Current
code stores an ERR_PTR when imx8qxp_pxl2dpi_find_next_bridge() errors
out. Instead of fixing that after the facts in the caller, change the
function to internally set the next_pointer and just return an int error
value.
imx8qxp_pxl2dpi_find_next_bridge() already emits a DRM_DEV_ERROR() for
every error except -EPROBE_DEFER. The caller emits another one, which is
redundant. Remove the message in the caller and keep the two in
imx8qxp_pxl2dpi_find_next_bridge() as they are more informative about the
error cause.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:45 +0000 (18:58 +0100)]
drm/meson: encoder_hdmi: get/put the next bridge
This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
function and stores it until driver removal. of_drm_find_bridge() is
deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
refcounted and use bridge->next_bridge to put the reference on
deallocation.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:44 +0000 (18:58 +0100)]
drm/meson: encoder_dsi: get/put the next bridge
This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
function and stores it until driver removal. of_drm_find_bridge() is
deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
refcounted and use bridge->next_bridge to put the reference on
deallocation.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:43 +0000 (18:58 +0100)]
drm/meson: encoder_cvbs: get/put the next bridge
This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
function and stores it until driver removal. of_drm_find_bridge() is
deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
refcounted and use bridge->next_bridge to put the reference on
deallocation.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:42 +0000 (18:58 +0100)]
drm/bridge: simple-bridge: get/put the next bridge
This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
function and stores it until driver removal. of_drm_find_bridge() is
deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
refcounted and use bridge->next_bridge to put the reference on
deallocation.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:41 +0000 (18:58 +0100)]
drm/bridge: imx8qxp-pixel-combiner: get/put the next bridge
This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
function and stores it until driver removal. of_drm_find_bridge() is
deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
refcounted and use bridge->next_bridge to put the reference on
deallocation.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:40 +0000 (18:58 +0100)]
drm/bridge: ite-it66121: get/put the next bridge
This driver obtains a bridge pointer from of_drm_find_bridge() in the probe
function and stores it until driver removal. of_drm_find_bridge() is
deprecated. Move to of_drm_find_and_get_bridge() for the bridge to be
refcounted and use bridge->next_bridge to put the reference on
deallocation.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:39 +0000 (18:58 +0100)]
drm/bridge: add next_bridge pointer to struct drm_bridge
Many bridge drivers store a next_bridge pointer in their private data and
use it for attach and sometimes other purposes. This is going to be risky
when bridge hot-unplug is used.
Considering this example scenario:
1. pipeline: encoder --> bridge A --> bridge B --> bridge C
2. encoder takes a reference to bridge B
3. bridge B takes a next_bridge reference to bridge C
4. encoder calls (bridge B)->b_foo(), which in turns references
next_bridge, e.g.:
b_foo() {
bar(b->next_bridge);
}
If bridges B and C are removed, bridge C can be freed but B is still
allocated because the encoder holds a reference to B. So when step 4
happens, 'b->next-bridge' would be a use-after-free.
Calling drm_bridge_put() in the B bridge .remove function does not solve
the problem as it leaves a (potentially long) risk window between B removal
and the final deallocation of B. A safe moment to put the B reference is in
__drm_bridge_free(), when the last reference has been put. This can be done
by drivers in the .destroy func. However to avoid the need for so many
drivers to implement a .destroy func, just offer a next_bridge pointer to
all bridges that is automatically put it in __drm_bridge_free(), exactly
when the .destroy func is called.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:38 +0000 (18:58 +0100)]
drm/arcpgu: convert to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated. Move to its replacement
of_drm_find_and_get_bridge() which gets a bridge reference, and ensure it
is put it when done.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:37 +0000 (18:58 +0100)]
drm/bridge: make of_drm_find_bridge() a wrapper of of_drm_find_and_get_bridge()
of_drm_find_bridge() is identical to of_drm_find_and_get_bridge() except it
does not increment the refcount. Rewrite it as a wrapper and put the bridge
being returned so the behaviour is still the same.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:36 +0000 (18:58 +0100)]
drm/todo: add entry about converting to of_drm_find_and_get_bridge()
of_drm_find_bridge() is deprecated, but converting some users is very
complex and should be reasonably doable only after the DRM panel bridge
lifetime rework. Add a TODO to track this.
Luca Ceresoli [Tue, 16 Dec 2025 17:58:34 +0000 (18:58 +0100)]
drm/bridge: add of_drm_find_and_get_bridge()
of_drm_find_bridge() does not increment the refcount for the returned
bridge, but that is required now. However converting it and all its users
is not realistically doable at once given the large amount of (direct and
indirect) callers and the complexity of some.
Solve this issue by creating a new of_drm_find_and_get_bridge() function
that is identical to of_drm_find_bridge() except also it takes a
reference. Then of_drm_find_bridge() will be deprecated to be eventually
removed.
drm/bridge: lontium-lt9611uxc: switch to HDMI audio helpers
While LT9611UXC is a DSI-to-HDMI bridge, it implements all HDMI-related
functions internally, in the firmware, thus it doesn't make sense to
implement DRM_BRIDGE_OP_HDMI. However it is possible to implement
DRM_BRIDGE_OP_HDMI_AUDIO, streamlining HDMI audio plumbing (which
includes plugged notifications and ELD handling).
Implement corresponding callbacks and trigger EDID read /
drm_connector_hdmi_audio_plugged_notify() from the hpd_notify callback.
drm/bridge: add connector argument to .hpd_notify callback
Drivers might need to update DRM connector in the
drm_bridge_funcs.hpd_notify callback (e.g. it might be necessary to
update EDID before setting ELD). Add corresponding argument to the
callback.
Jani Nikula [Fri, 19 Dec 2025 11:49:39 +0000 (13:49 +0200)]
drm/atomic: convert drm_atomic_get_{old, new}_colorop_state() into proper functions
There is no real reason to include drm_colorop.h from drm_atomic.h, as
drm_atomic_get_{old,new}_colorop_state() have no real reason to be
static inline.
Convert the static inlines to proper functions, and drop the include to
reduce the include dependencies and improve data hiding.
v2: Fix vkms build failures (Alex)
Fixes: cfc27680ee20 ("drm/colorop: Introduce new drm_colorop mode object") Cc: Simon Ser <contact@emersion.fr> Cc: Alex Hung <alex.hung@amd.com> Cc: Harry Wentland <harry.wentland@amd.com> Cc: Daniel Stone <daniels@collabora.com> Cc: Melissa Wen <mwen@igalia.com> Cc: Sebastian Wick <sebastian.wick@redhat.com> Cc: Alex Hung <alex.hung@amd.com> Reviewed-by: Alex Hung <alex.hung@amd.com> Link: https://patch.msgid.link/20251219114939.1069851-1-jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
René Rebe [Fri, 12 Dec 2025 20:05:04 +0000 (21:05 +0100)]
drm/ast: Swap framebuffer writes on big-endian machines
Swap the pixel data when writing to framebuffer memory on big-endian
machines. Fixes incorrect output. Aspeed graphics does not appear to
support big-endian framebuffers after AST2400, although the feature
has been documented.
There's a lengthy discussion at [1].
v5:
- avoid restricted cast from __be16 (kernel test robot)
drm/tests: shmem: Hold reservation lock around purge
Acquire and release the GEM object's reservation lock around calls
to the object's purge operation. The tests use
drm_gem_shmem_purge_locked(), which led to errors such as show below.
[ 58.709128] WARNING: CPU: 1 PID: 1354 at drivers/gpu/drm/drm_gem_shmem_helper.c:515 drm_gem_shmem_purge_locked+0x51c/0x740
Only export the new helper drm_gem_shmem_purge() for Kunit tests.
This is not an interface for regular drivers.
drm/tests: shmem: Hold reservation lock around madvise
Acquire and release the GEM object's reservation lock around calls
to the object's madvide operation. The tests use
drm_gem_shmem_madvise_locked(), which led to errors such as show below.
[ 58.339389] WARNING: CPU: 1 PID: 1352 at drivers/gpu/drm/drm_gem_shmem_helper.c:499 drm_gem_shmem_madvise_locked+0xde/0x140
Only export the new helper drm_gem_shmem_madvise() for Kunit tests.
This is not an interface for regular drivers.
drm/tests: shmem: Hold reservation lock around vmap/vunmap
Acquire and release the GEM object's reservation lock around vmap and
vunmap operations. The tests use vmap_locked, which led to errors such
as show below.
[ 122.292030] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:390 drm_gem_shmem_vmap_locked+0x3a3/0x6f0
[ 122.468066] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:293 drm_gem_shmem_pin_locked+0x1fe/0x350
[ 122.563504] WARNING: CPU: 3 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:234 drm_gem_shmem_get_pages_locked+0x23c/0x370
[ 122.662248] WARNING: CPU: 2 PID: 1413 at drivers/gpu/drm/drm_gem_shmem_helper.c:452 drm_gem_shmem_vunmap_locked+0x101/0x330
Only export the new vmap/vunmap helpers for Kunit tests. These are
not interfaces for regular drivers.
GEM SHMEM has 2 helpers for exporting S/G tables. Swap the names of
the rsp. tests, so that each matches the helper it tests.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: 93032ae634d4 ("drm/test: add a test suite for GEM objects backed by shmem") Cc: dri-devel@lists.freedesktop.org Cc: <stable@vger.kernel.org> # v6.8+ Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Link: https://patch.msgid.link/20251212160317.287409-2-tzimmermann@suse.de
Biju Das [Wed, 3 Dec 2025 12:51:01 +0000 (12:51 +0000)]
drm/panfrost: Add GPU_PM_RT support for RZ/G3E SoC
RZ/G3E SoC is embedded with Mali-G52 GPU system. The system hangs after
STR in the following condition:
STR -> Wakeup from STR -> Unload panfrost using 'modprobe -r panfrost'.
Fix this issue by asserting/deasserting the reset during suspend/resume.
Rename the variable allwinner_h616_data->default_pm_rt_data for data
reuse and make it as generic GPU PM runtime data.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Adrián Larumbe <adrian.larumbe@collabora.com> Reviewed-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20251203125104.67596-1-biju.das.jz@bp.renesas.com Signed-off-by: Adrian Larumbe <adrianml@alumnos.upm.es>
Francesco Valla [Wed, 17 Dec 2025 08:06:56 +0000 (09:06 +0100)]
drm/panic: avoid WARN when checking format support
Use drm_draw_can_convert_from_xrgb8888() instead of
drm_draw_color_from_xrgb8888() while checking if a color format is
usable. This avoids a WARN in case the first format is not usable.
Francesco Valla [Wed, 17 Dec 2025 08:06:55 +0000 (09:06 +0100)]
drm/log: avoid WARN when searching for usable format
Use drm_draw_can_convert_from_xrgb8888() instead of
drm_draw_color_from_xrgb8888() while searching for a usable color
format. This avoids a WARN in case the first format is not usable.
Adrián Larumbe [Wed, 17 Dec 2025 21:32:33 +0000 (21:32 +0000)]
drm/panthor: Support partial unmaps of huge pages
Commit 33729a5fc0ca ("iommu/io-pgtable-arm: Remove split on unmap
behavior") did away with the treatment of partial unmaps of huge IOPTEs.
In the case of Panthor, that means an attempt to run a VM_BIND unmap
operation on a memory region whose start address and size aren't 2MiB
aligned, in the event it intersects with a huge page, would lead to ARM
IOMMU management code to fail and a warning being raised.
Presently, and for lack of a better alternative, it's best to have
Panthor handle partial unmaps at the driver level, by unmapping entire
huge pages and remapping the difference between them and the requested
unmap region.
This could change in the future when the VM_BIND uAPI is expanded to
enforce huge page alignment and map/unmap operational constraints that
render this code unnecessary.
When a partial unmap for a huge PTE is attempted, we also need to expand
the locked region to encompass whole huge pages.
Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com> Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Reviewed-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20251217213252.677020-2-adrian.larumbe@collabora.com Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Ketil Johnsen [Fri, 19 Dec 2025 09:35:44 +0000 (10:35 +0100)]
drm/panthor: Evict groups before VM termination
Ensure all related groups are evicted and suspended before VM
destruction takes place.
This fixes an issue where panthor_vm_destroy() destroys and unmaps the
heap context while there are still on slot groups using this.
The FW will do a write out to the heap context when a CSG (group) is
suspended, so a premature unmap of the heap context will cause a
GPU page fault.
This page fault is quite harmless, and do not affect the continued
operation of the GPU.
Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block") Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Ketil Johnsen <ketil.johnsen@arm.com> Reviewed-by: Liviu Dudau <liviu.dudau@arm.com> Reviewed-by: Steven Price <steven.price@arm.com> Link: https://patch.msgid.link/20251219093546.1227697-1-ketil.johnsen@arm.com Co-developed-by: Boris Brezillon <boris.brezillon@collabora.com> Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
projects / thirdparty / kernel / linux.git / log
