--- /dev/null
+From 5949e7c4890c3cf65e783c83c355b95e21f10dba Mon Sep 17 00:00:00 2001
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Date: Wed, 24 Sep 2025 14:37:01 -0400
+Subject: drm/amd/display: Enable Dynamic DTBCLK Switch
+
+From: Fangzhi Zuo <Jerry.Zuo@amd.com>
+
+commit 5949e7c4890c3cf65e783c83c355b95e21f10dba upstream.
+
+[WHAT]
+Since dcn35, DTBCLK can be disabled when no DP2 sink connected for
+power saving purpose.
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1956,6 +1956,10 @@ static int amdgpu_dm_init(struct amdgpu_
+
+ init_data.flags.disable_ips_in_vpb = 0;
+
++ /* DCN35 and above supports dynamic DTBCLK switch */
++ if (amdgpu_ip_version(adev, DCE_HWIP, 0) >= IP_VERSION(3, 5, 0))
++ init_data.flags.allow_0_dtb_clk = true;
++
+ /* Enable DWB for tested platforms only */
+ if (amdgpu_ip_version(adev, DCE_HWIP, 0) >= IP_VERSION(3, 0, 0))
+ init_data.num_virtual_links = 1;
--- /dev/null
+From ddbfac152830e38d488ff8e45ab7eaf5d72f8527 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Thu, 2 Oct 2025 23:00:45 +0200
+Subject: drm/amd/display: Fix unsafe uses of kernel mode FPU
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit ddbfac152830e38d488ff8e45ab7eaf5d72f8527 upstream.
+
+The point of isolating code that uses kernel mode FPU in separate
+compilation units is to ensure that even implicit uses of, e.g., SIMD
+registers for spilling occur only in a context where this is permitted,
+i.e., from inside a kernel_fpu_begin/end block.
+
+This is important on arm64, which uses -mgeneral-regs-only to build all
+kernel code, with the exception of such compilation units where FP or
+SIMD registers are expected to be used. Given that the compiler may
+invent uses of FP/SIMD anywhere in such a unit, none of its code may be
+accessible from outside a kernel_fpu_begin/end block.
+
+This means that all callers into such compilation units must use the
+DC_FP start/end macros, which must not occur there themselves. For
+robustness, all functions with external linkage that reside there should
+call dc_assert_fp_enabled() to assert that the FPU context was set up
+correctly.
+
+Fix this for the DCN35, DCN351 and DCN36 implementations.
+
+Cc: Austin Zheng <austin.zheng@amd.com>
+Cc: Jun Lei <jun.lei@amd.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Leo Li <sunpeng.li@amd.com>
+Cc: Rodrigo Siqueira <siqueira@igalia.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: "Christian König" <christian.koenig@amd.com>
+Cc: amd-gfx@lists.freedesktop.org
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c | 4 ++
+ drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c | 6 ++-
+ drivers/gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c | 4 +-
+ drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c | 16 ++++++++-
+ drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c | 17 +++++++++-
+ drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c | 16 ++++++++-
+ 6 files changed, 56 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn31/dcn31_fpu.c
+@@ -808,6 +808,8 @@ void dcn316_update_bw_bounding_box(struc
+
+ int dcn_get_max_non_odm_pix_rate_100hz(struct _vcs_dpi_soc_bounding_box_st *soc)
+ {
++ dc_assert_fp_enabled();
++
+ return soc->clock_limits[0].dispclk_mhz * 10000.0 / (1.0 + soc->dcn_downspread_percent / 100.0);
+ }
+
+@@ -815,6 +817,8 @@ int dcn_get_approx_det_segs_required_for
+ struct _vcs_dpi_soc_bounding_box_st *soc,
+ int pix_clk_100hz, int bpp, int seg_size_kb)
+ {
++ dc_assert_fp_enabled();
++
+ /* Roughly calculate required crb to hide latency. In practice there is slightly
+ * more buffer available for latency hiding
+ */
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn35/dcn35_fpu.c
+@@ -445,6 +445,8 @@ int dcn35_populate_dml_pipes_from_contex
+ bool upscaled = false;
+ const unsigned int max_allowed_vblank_nom = 1023;
+
++ dc_assert_fp_enabled();
++
+ dcn31_populate_dml_pipes_from_context(dc, context, pipes,
+ validate_mode);
+
+@@ -498,9 +500,7 @@ int dcn35_populate_dml_pipes_from_contex
+
+ pipes[pipe_cnt].pipe.src.unbounded_req_mode = false;
+
+- DC_FP_START();
+ dcn31_zero_pipe_dcc_fraction(pipes, pipe_cnt);
+- DC_FP_END();
+
+ pipes[pipe_cnt].pipe.dest.vfront_porch = timing->v_front_porch;
+ pipes[pipe_cnt].pipe.src.dcc_rate = 3;
+@@ -581,6 +581,8 @@ void dcn35_decide_zstate_support(struct
+ unsigned int i, plane_count = 0;
+ DC_LOGGER_INIT(dc->ctx->logger);
+
++ dc_assert_fp_enabled();
++
+ for (i = 0; i < dc->res_pool->pipe_count; i++) {
+ if (context->res_ctx.pipe_ctx[i].plane_state)
+ plane_count++;
+--- a/drivers/gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn351/dcn351_fpu.c
+@@ -478,6 +478,8 @@ int dcn351_populate_dml_pipes_from_conte
+ bool upscaled = false;
+ const unsigned int max_allowed_vblank_nom = 1023;
+
++ dc_assert_fp_enabled();
++
+ dcn31_populate_dml_pipes_from_context(dc, context, pipes,
+ validate_mode);
+
+@@ -531,9 +533,7 @@ int dcn351_populate_dml_pipes_from_conte
+
+ pipes[pipe_cnt].pipe.src.unbounded_req_mode = false;
+
+- DC_FP_START();
+ dcn31_zero_pipe_dcc_fraction(pipes, pipe_cnt);
+- DC_FP_END();
+
+ pipes[pipe_cnt].pipe.dest.vfront_porch = timing->v_front_porch;
+ pipes[pipe_cnt].pipe.src.dcc_rate = 3;
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c
+@@ -1760,6 +1760,20 @@ enum dc_status dcn35_patch_unknown_plane
+ }
+
+
++static int populate_dml_pipes_from_context_fpu(struct dc *dc,
++ struct dc_state *context,
++ display_e2e_pipe_params_st *pipes,
++ enum dc_validate_mode validate_mode)
++{
++ int ret;
++
++ DC_FP_START();
++ ret = dcn35_populate_dml_pipes_from_context_fpu(dc, context, pipes, validate_mode);
++ DC_FP_END();
++
++ return ret;
++}
++
+ static struct resource_funcs dcn35_res_pool_funcs = {
+ .destroy = dcn35_destroy_resource_pool,
+ .link_enc_create = dcn35_link_encoder_create,
+@@ -1770,7 +1784,7 @@ static struct resource_funcs dcn35_res_p
+ .validate_bandwidth = dcn35_validate_bandwidth,
+ .calculate_wm_and_dlg = NULL,
+ .update_soc_for_wm_a = dcn31_update_soc_for_wm_a,
+- .populate_dml_pipes = dcn35_populate_dml_pipes_from_context_fpu,
++ .populate_dml_pipes = populate_dml_pipes_from_context_fpu,
+ .acquire_free_pipe_as_secondary_dpp_pipe = dcn20_acquire_free_pipe_for_layer,
+ .release_pipe = dcn20_release_pipe,
+ .add_stream_to_ctx = dcn30_add_stream_to_ctx,
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c
+@@ -1732,6 +1732,21 @@ static enum dc_status dcn351_validate_ba
+ return out ? DC_OK : DC_FAIL_BANDWIDTH_VALIDATE;
+ }
+
++static int populate_dml_pipes_from_context_fpu(struct dc *dc,
++ struct dc_state *context,
++ display_e2e_pipe_params_st *pipes,
++ enum dc_validate_mode validate_mode)
++{
++ int ret;
++
++ DC_FP_START();
++ ret = dcn351_populate_dml_pipes_from_context_fpu(dc, context, pipes, validate_mode);
++ DC_FP_END();
++
++ return ret;
++
++}
++
+ static struct resource_funcs dcn351_res_pool_funcs = {
+ .destroy = dcn351_destroy_resource_pool,
+ .link_enc_create = dcn35_link_encoder_create,
+@@ -1742,7 +1757,7 @@ static struct resource_funcs dcn351_res_
+ .validate_bandwidth = dcn351_validate_bandwidth,
+ .calculate_wm_and_dlg = NULL,
+ .update_soc_for_wm_a = dcn31_update_soc_for_wm_a,
+- .populate_dml_pipes = dcn351_populate_dml_pipes_from_context_fpu,
++ .populate_dml_pipes = populate_dml_pipes_from_context_fpu,
+ .acquire_free_pipe_as_secondary_dpp_pipe = dcn20_acquire_free_pipe_for_layer,
+ .release_pipe = dcn20_release_pipe,
+ .add_stream_to_ctx = dcn30_add_stream_to_ctx,
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn36/dcn36_resource.c
+@@ -1734,6 +1734,20 @@ static enum dc_status dcn35_validate_ban
+ }
+
+
++static int populate_dml_pipes_from_context_fpu(struct dc *dc,
++ struct dc_state *context,
++ display_e2e_pipe_params_st *pipes,
++ enum dc_validate_mode validate_mode)
++{
++ int ret;
++
++ DC_FP_START();
++ ret = dcn35_populate_dml_pipes_from_context_fpu(dc, context, pipes, validate_mode);
++ DC_FP_END();
++
++ return ret;
++}
++
+ static struct resource_funcs dcn36_res_pool_funcs = {
+ .destroy = dcn36_destroy_resource_pool,
+ .link_enc_create = dcn35_link_encoder_create,
+@@ -1744,7 +1758,7 @@ static struct resource_funcs dcn36_res_p
+ .validate_bandwidth = dcn35_validate_bandwidth,
+ .calculate_wm_and_dlg = NULL,
+ .update_soc_for_wm_a = dcn31_update_soc_for_wm_a,
+- .populate_dml_pipes = dcn35_populate_dml_pipes_from_context_fpu,
++ .populate_dml_pipes = populate_dml_pipes_from_context_fpu,
+ .acquire_free_pipe_as_secondary_dpp_pipe = dcn20_acquire_free_pipe_for_layer,
+ .release_pipe = dcn20_release_pipe,
+ .add_stream_to_ctx = dcn30_add_stream_to_ctx,
--- /dev/null
+From d07e142641417e67f3bfc9d8ba3da8a69c39cfcd Mon Sep 17 00:00:00 2001
+From: Jesse Agate <jesse.agate@amd.com>
+Date: Fri, 13 Jun 2025 14:20:53 -0400
+Subject: drm/amd/display: Incorrect Mirror Cositing
+
+From: Jesse Agate <jesse.agate@amd.com>
+
+commit d07e142641417e67f3bfc9d8ba3da8a69c39cfcd upstream.
+
+[WHY]
+hinit/vinit are incorrect in the case of mirroring.
+
+[HOW]
+Cositing sign must be flipped when image is mirrored in the vertical
+or horizontal direction.
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Samson Tam <samson.tam@amd.com>
+Signed-off-by: Jesse Agate <jesse.agate@amd.com>
+Signed-off-by: Brendan Leder <breleder@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c
++++ b/drivers/gpu/drm/amd/display/dc/sspl/dc_spl.c
+@@ -641,16 +641,16 @@ static void spl_calculate_inits_and_view
+ /* this gives the direction of the cositing (negative will move
+ * left, right otherwise)
+ */
+- int sign = 1;
++ int h_sign = flip_horz_scan_dir ? -1 : 1;
++ int v_sign = flip_vert_scan_dir ? -1 : 1;
+
+ switch (spl_in->basic_in.cositing) {
+-
+ case CHROMA_COSITING_TOPLEFT:
+- init_adj_h = spl_fixpt_from_fraction(sign, 4);
+- init_adj_v = spl_fixpt_from_fraction(sign, 4);
++ init_adj_h = spl_fixpt_from_fraction(h_sign, 4);
++ init_adj_v = spl_fixpt_from_fraction(v_sign, 4);
+ break;
+ case CHROMA_COSITING_LEFT:
+- init_adj_h = spl_fixpt_from_fraction(sign, 4);
++ init_adj_h = spl_fixpt_from_fraction(h_sign, 4);
+ init_adj_v = spl_fixpt_zero;
+ break;
+ case CHROMA_COSITING_NONE:
--- /dev/null
+From e1361a4f1be9cb69a662c6d7b5ce218007d6e82b Mon Sep 17 00:00:00 2001
+From: Kaustabh Chakraborty <kauschluss@disroot.org>
+Date: Sun, 6 Jul 2025 22:59:46 +0530
+Subject: drm/exynos: exynos7_drm_decon: remove ctx->suspended
+
+From: Kaustabh Chakraborty <kauschluss@disroot.org>
+
+commit e1361a4f1be9cb69a662c6d7b5ce218007d6e82b upstream.
+
+Condition guards are found to be redundant, as the call flow is properly
+managed now, as also observed in the Exynos5433 DECON driver. Since
+state checking is no longer necessary, remove it.
+
+This also fixes an issue which prevented decon_commit() from
+decon_atomic_enable() due to an incorrect state change setting.
+
+Fixes: 96976c3d9aff ("drm/exynos: Add DECON driver")
+Cc: stable@vger.kernel.org
+Suggested-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Kaustabh Chakraborty <kauschluss@disroot.org>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/exynos/exynos7_drm_decon.c | 36 -----------------------------
+ 1 file changed, 36 deletions(-)
+
+--- a/drivers/gpu/drm/exynos/exynos7_drm_decon.c
++++ b/drivers/gpu/drm/exynos/exynos7_drm_decon.c
+@@ -69,7 +69,6 @@ struct decon_context {
+ void __iomem *regs;
+ unsigned long irq_flags;
+ bool i80_if;
+- bool suspended;
+ wait_queue_head_t wait_vsync_queue;
+ atomic_t wait_vsync_event;
+
+@@ -132,9 +131,6 @@ static void decon_shadow_protect_win(str
+
+ static void decon_wait_for_vblank(struct decon_context *ctx)
+ {
+- if (ctx->suspended)
+- return;
+-
+ atomic_set(&ctx->wait_vsync_event, 1);
+
+ /*
+@@ -210,9 +206,6 @@ static void decon_commit(struct exynos_d
+ struct drm_display_mode *mode = &crtc->base.state->adjusted_mode;
+ u32 val, clkdiv;
+
+- if (ctx->suspended)
+- return;
+-
+ /* nothing to do if we haven't set the mode yet */
+ if (mode->htotal == 0 || mode->vtotal == 0)
+ return;
+@@ -274,9 +267,6 @@ static int decon_enable_vblank(struct ex
+ struct decon_context *ctx = crtc->ctx;
+ u32 val;
+
+- if (ctx->suspended)
+- return -EPERM;
+-
+ if (!test_and_set_bit(0, &ctx->irq_flags)) {
+ val = readl(ctx->regs + VIDINTCON0);
+
+@@ -299,9 +289,6 @@ static void decon_disable_vblank(struct
+ struct decon_context *ctx = crtc->ctx;
+ u32 val;
+
+- if (ctx->suspended)
+- return;
+-
+ if (test_and_clear_bit(0, &ctx->irq_flags)) {
+ val = readl(ctx->regs + VIDINTCON0);
+
+@@ -404,9 +391,6 @@ static void decon_atomic_begin(struct ex
+ struct decon_context *ctx = crtc->ctx;
+ int i;
+
+- if (ctx->suspended)
+- return;
+-
+ for (i = 0; i < WINDOWS_NR; i++)
+ decon_shadow_protect_win(ctx, i, true);
+ }
+@@ -427,9 +411,6 @@ static void decon_update_plane(struct ex
+ unsigned int pitch = fb->pitches[0];
+ unsigned int vidw_addr0_base = ctx->data->vidw_buf_start_base;
+
+- if (ctx->suspended)
+- return;
+-
+ /*
+ * SHADOWCON/PRTCON register is used for enabling timing.
+ *
+@@ -517,9 +498,6 @@ static void decon_disable_plane(struct e
+ unsigned int win = plane->index;
+ u32 val;
+
+- if (ctx->suspended)
+- return;
+-
+ /* protect windows */
+ decon_shadow_protect_win(ctx, win, true);
+
+@@ -538,9 +516,6 @@ static void decon_atomic_flush(struct ex
+ struct decon_context *ctx = crtc->ctx;
+ int i;
+
+- if (ctx->suspended)
+- return;
+-
+ for (i = 0; i < WINDOWS_NR; i++)
+ decon_shadow_protect_win(ctx, i, false);
+ exynos_crtc_handle_event(crtc);
+@@ -568,9 +543,6 @@ static void decon_atomic_enable(struct e
+ struct decon_context *ctx = crtc->ctx;
+ int ret;
+
+- if (!ctx->suspended)
+- return;
+-
+ ret = pm_runtime_resume_and_get(ctx->dev);
+ if (ret < 0) {
+ DRM_DEV_ERROR(ctx->dev, "failed to enable DECON device.\n");
+@@ -584,8 +556,6 @@ static void decon_atomic_enable(struct e
+ decon_enable_vblank(ctx->crtc);
+
+ decon_commit(ctx->crtc);
+-
+- ctx->suspended = false;
+ }
+
+ static void decon_atomic_disable(struct exynos_drm_crtc *crtc)
+@@ -593,9 +563,6 @@ static void decon_atomic_disable(struct
+ struct decon_context *ctx = crtc->ctx;
+ int i;
+
+- if (ctx->suspended)
+- return;
+-
+ /*
+ * We need to make sure that all windows are disabled before we
+ * suspend that connector. Otherwise we might try to scan from
+@@ -605,8 +572,6 @@ static void decon_atomic_disable(struct
+ decon_disable_plane(crtc, &ctx->planes[i]);
+
+ pm_runtime_put_sync(ctx->dev);
+-
+- ctx->suspended = true;
+ }
+
+ static const struct exynos_drm_crtc_ops decon_crtc_ops = {
+@@ -727,7 +692,6 @@ static int decon_probe(struct platform_d
+ return -ENOMEM;
+
+ ctx->dev = dev;
+- ctx->suspended = true;
+ ctx->data = of_device_get_match_data(dev);
+
+ i80_if_timings = of_get_child_by_name(dev->of_node, "i80-if-timings");
--- /dev/null
+From f248d5d5159a88ded55329f0b1b463d0f4094228 Mon Sep 17 00:00:00 2001
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Date: Mon, 8 Sep 2025 13:56:57 +0530
+Subject: drm/msm/a6xx: Fix PDC sleep sequence
+
+From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+
+commit f248d5d5159a88ded55329f0b1b463d0f4094228 upstream.
+
+Since the PDC resides out of the GPU subsystem and cannot be reset in
+case it enters bad state, utmost care must be taken to trigger the PDC
+wake/sleep routines in the correct order.
+
+The PDC wake sequence can be exercised only after a PDC sleep sequence.
+Additionally, GMU firmware should initialize a few registers before the
+KMD can trigger a PDC sleep sequence. So PDC sleep can't be done if the
+GMU firmware has not initialized. Track these dependencies using a new
+status variable and trigger PDC sleep/wake sequences appropriately.
+
+Cc: stable@vger.kernel.org
+Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support")
+Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
+Patchwork: https://patchwork.freedesktop.org/patch/673362/
+Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 28 +++++++++++++++++-----------
+ drivers/gpu/drm/msm/adreno/a6xx_gmu.h | 6 ++++++
+ 2 files changed, 23 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+@@ -272,6 +272,8 @@ static int a6xx_gmu_start(struct a6xx_gm
+ if (ret)
+ DRM_DEV_ERROR(gmu->dev, "GMU firmware initialization timed out\n");
+
++ set_bit(GMU_STATUS_FW_START, &gmu->status);
++
+ return ret;
+ }
+
+@@ -518,6 +520,9 @@ static int a6xx_rpmh_start(struct a6xx_g
+ int ret;
+ u32 val;
+
++ if (!test_and_clear_bit(GMU_STATUS_PDC_SLEEP, &gmu->status))
++ return 0;
++
+ gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, BIT(1));
+
+ ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_RSCC_CONTROL_ACK, val,
+@@ -545,6 +550,9 @@ static void a6xx_rpmh_stop(struct a6xx_g
+ int ret;
+ u32 val;
+
++ if (test_and_clear_bit(GMU_STATUS_FW_START, &gmu->status))
++ return;
++
+ gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 1);
+
+ ret = gmu_poll_timeout_rscc(gmu, REG_A6XX_GPU_RSCC_RSC_STATUS0_DRV0,
+@@ -553,6 +561,8 @@ static void a6xx_rpmh_stop(struct a6xx_g
+ DRM_DEV_ERROR(gmu->dev, "Unable to power off the GPU RSC\n");
+
+ gmu_write(gmu, REG_A6XX_GMU_RSCC_CONTROL_REQ, 0);
++
++ set_bit(GMU_STATUS_PDC_SLEEP, &gmu->status);
+ }
+
+ static inline void pdc_write(void __iomem *ptr, u32 offset, u32 value)
+@@ -681,8 +691,6 @@ setup_pdc:
+ /* ensure no writes happen before the uCode is fully written */
+ wmb();
+
+- a6xx_rpmh_stop(gmu);
+-
+ err:
+ if (!IS_ERR_OR_NULL(pdcptr))
+ iounmap(pdcptr);
+@@ -842,19 +850,15 @@ static int a6xx_gmu_fw_start(struct a6xx
+ else
+ gmu_write(gmu, REG_A6XX_GMU_GENERAL_7, 1);
+
+- if (state == GMU_WARM_BOOT) {
+- ret = a6xx_rpmh_start(gmu);
+- if (ret)
+- return ret;
+- } else {
++ ret = a6xx_rpmh_start(gmu);
++ if (ret)
++ return ret;
++
++ if (state == GMU_COLD_BOOT) {
+ if (WARN(!adreno_gpu->fw[ADRENO_FW_GMU],
+ "GMU firmware is not loaded\n"))
+ return -ENOENT;
+
+- ret = a6xx_rpmh_start(gmu);
+- if (ret)
+- return ret;
+-
+ ret = a6xx_gmu_fw_load(gmu);
+ if (ret)
+ return ret;
+@@ -1023,6 +1027,8 @@ static void a6xx_gmu_force_off(struct a6
+
+ /* Reset GPU core blocks */
+ a6xx_gpu_sw_reset(gpu, true);
++
++ a6xx_rpmh_stop(gmu);
+ }
+
+ static void a6xx_gmu_set_initial_freq(struct msm_gpu *gpu, struct a6xx_gmu *gmu)
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.h
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.h
+@@ -117,6 +117,12 @@ struct a6xx_gmu {
+
+ struct qmp *qmp;
+ struct a6xx_hfi_msg_bw_table *bw_table;
++
++/* To check if we can trigger sleep seq at PDC. Cleared in a6xx_rpmh_stop() */
++#define GMU_STATUS_FW_START 0
++/* To track if PDC sleep seq was done */
++#define GMU_STATUS_PDC_SLEEP 1
++ unsigned long status;
+ };
+
+ static inline u32 gmu_read(struct a6xx_gmu *gmu, u32 offset)
--- /dev/null
+From e4bea919584ff292c9156cf7d641a2ab3cbe27b0 Mon Sep 17 00:00:00 2001
+From: Shuhao Fu <sfual@cse.ust.hk>
+Date: Wed, 8 Oct 2025 00:17:09 +0800
+Subject: drm/nouveau: fix bad ret code in nouveau_bo_move_prep
+
+From: Shuhao Fu <sfual@cse.ust.hk>
+
+commit e4bea919584ff292c9156cf7d641a2ab3cbe27b0 upstream.
+
+In `nouveau_bo_move_prep`, if `nouveau_mem_map` fails, an error code
+should be returned. Currently, it returns zero even if vmm addr is not
+correctly mapped.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Petr Vorel <pvorel@suse.cz>
+Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
+Fixes: 9ce523cc3bf2 ("drm/nouveau: separate buffer object backing memory from nvkm structures")
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -929,7 +929,7 @@ done:
+ nvif_vmm_put(vmm, &old_mem->vma[1]);
+ nvif_vmm_put(vmm, &old_mem->vma[0]);
+ }
+- return 0;
++ return ret;
+ }
+
+ static int
--- /dev/null
+From ca2a6abdaee43808034cdb218428d2ed85fd3db8 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Wed, 13 Nov 2024 22:03:39 +0100
+Subject: drm/panthor: Fix memory leak in panthor_ioctl_group_create()
+
+From: Jann Horn <jannh@google.com>
+
+commit ca2a6abdaee43808034cdb218428d2ed85fd3db8 upstream.
+
+When bailing out due to group_priority_permit() failure, the queue_args
+need to be freed. Fix it by rearranging the function to use the
+goto-on-error pattern, such that the success case flows straight without
+indentation while error cases jump forward to cleanup.
+
+Cc: stable@vger.kernel.org
+Fixes: 5f7762042f8a ("drm/panthor: Restrict high priorities on group_create")
+Signed-off-by: Jann Horn <jannh@google.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://lore.kernel.org/r/20241113-panthor-fix-gcq-bailout-v1-1-654307254d68@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/panthor/panthor_drv.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/panthor/panthor_drv.c
++++ b/drivers/gpu/drm/panthor/panthor_drv.c
+@@ -1103,14 +1103,15 @@ static int panthor_ioctl_group_create(st
+
+ ret = group_priority_permit(file, args->priority);
+ if (ret)
+- return ret;
++ goto out;
+
+ ret = panthor_group_create(pfile, args, queue_args);
+- if (ret >= 0) {
+- args->group_handle = ret;
+- ret = 0;
+- }
++ if (ret < 0)
++ goto out;
++ args->group_handle = ret;
++ ret = 0;
+
++out:
+ kvfree(queue_args);
+ return ret;
+ }
--- /dev/null
+From d83f1d19c898ac1b54ae64d1c950f5beff801982 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Date: Wed, 13 Aug 2025 23:08:13 +0200
+Subject: drm/rcar-du: dsi: Fix 1/2/3 lane support
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+commit d83f1d19c898ac1b54ae64d1c950f5beff801982 upstream.
+
+Remove fixed PPI lane count setup. The R-Car DSI host is capable
+of operating in 1..4 DSI lane mode. Remove the hard-coded 4-lane
+configuration from PPI register settings and instead configure
+the PPI lane count according to lane count information already
+obtained by this driver instance.
+
+Configure TXSETR register to match PPI lane count. The R-Car V4H
+Reference Manual R19UH0186EJ0121 Rev.1.21 section 67.2.2.3 Tx Set
+Register (TXSETR), field LANECNT description indicates that the
+TXSETR register LANECNT bitfield lane count must be configured
+such, that it matches lane count configuration in PPISETR register
+DLEN bitfield. Make sure the LANECNT and DLEN bitfields are
+configured to match.
+
+Fixes: 155358310f01 ("drm: rcar-du: Add R-Car DSI driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
+Link: https://lore.kernel.org/r/20250813210840.97621-1-marek.vasut+renesas@mailbox.org
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c | 5 ++++-
+ drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h | 8 ++++----
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c
++++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi.c
+@@ -576,7 +576,10 @@ static int rcar_mipi_dsi_startup(struct
+ udelay(10);
+ rcar_mipi_dsi_clr(dsi, CLOCKSET1, CLOCKSET1_UPDATEPLL);
+
+- ppisetr = PPISETR_DLEN_3 | PPISETR_CLEN;
++ rcar_mipi_dsi_clr(dsi, TXSETR, TXSETR_LANECNT_MASK);
++ rcar_mipi_dsi_set(dsi, TXSETR, dsi->lanes - 1);
++
++ ppisetr = ((BIT(dsi->lanes) - 1) & PPISETR_DLEN_MASK) | PPISETR_CLEN;
+ rcar_mipi_dsi_write(dsi, PPISETR, ppisetr);
+
+ rcar_mipi_dsi_set(dsi, PHYSETUP, PHYSETUP_SHUTDOWNZ);
+--- a/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h
++++ b/drivers/gpu/drm/renesas/rcar-du/rcar_mipi_dsi_regs.h
+@@ -12,6 +12,9 @@
+ #define LINKSR_LPBUSY (1 << 1)
+ #define LINKSR_HSBUSY (1 << 0)
+
++#define TXSETR 0x100
++#define TXSETR_LANECNT_MASK (0x3 << 0)
++
+ /*
+ * Video Mode Register
+ */
+@@ -80,10 +83,7 @@
+ * PHY-Protocol Interface (PPI) Registers
+ */
+ #define PPISETR 0x700
+-#define PPISETR_DLEN_0 (0x1 << 0)
+-#define PPISETR_DLEN_1 (0x3 << 0)
+-#define PPISETR_DLEN_2 (0x7 << 0)
+-#define PPISETR_DLEN_3 (0xf << 0)
++#define PPISETR_DLEN_MASK (0xf << 0)
+ #define PPISETR_CLEN (1 << 8)
+
+ #define PPICLCR 0x710
--- /dev/null
+From 2d1684a077d62fddfac074052c162ec6573a34e1 Mon Sep 17 00:00:00 2001
+From: Matthew Auld <matthew.auld@intel.com>
+Date: Fri, 19 Sep 2025 13:20:53 +0100
+Subject: drm/xe/uapi: loosen used tracking restriction
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+commit 2d1684a077d62fddfac074052c162ec6573a34e1 upstream.
+
+Currently this is hidden behind perfmon_capable() since this is
+technically an info leak, given that this is a system wide metric.
+However the granularity reported here is always PAGE_SIZE aligned, which
+matches what the core kernel is already willing to expose to userspace
+if querying how many free RAM pages there are on the system, and that
+doesn't need any special privileges. In addition other drm drivers seem
+happy to expose this.
+
+The motivation here if with oneAPI where they want to use the system
+wide 'used' reporting here, so not the per-client fdinfo stats. This has
+also come up with some perf overlay applications wanting this
+information.
+
+Fixes: 1105ac15d2a1 ("drm/xe/uapi: restrict system wide accounting")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Joshua Santosh <joshua.santosh.ranjan@intel.com>
+Cc: José Roberto de Souza <jose.souza@intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: <stable@vger.kernel.org> # v6.8+
+Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Link: https://lore.kernel.org/r/20250919122052.420979-2-matthew.auld@intel.com
+(cherry picked from commit 4d0b035fd6dae8ee48e9c928b10f14877e595356)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_query.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_query.c
++++ b/drivers/gpu/drm/xe/xe_query.c
+@@ -274,8 +274,7 @@ static int query_mem_regions(struct xe_d
+ mem_regions->mem_regions[0].instance = 0;
+ mem_regions->mem_regions[0].min_page_size = PAGE_SIZE;
+ mem_regions->mem_regions[0].total_size = man->size << PAGE_SHIFT;
+- if (perfmon_capable())
+- mem_regions->mem_regions[0].used = ttm_resource_manager_usage(man);
++ mem_regions->mem_regions[0].used = ttm_resource_manager_usage(man);
+ mem_regions->num_mem_regions = 1;
+
+ for (i = XE_PL_VRAM0; i <= XE_PL_VRAM1; ++i) {
+@@ -291,13 +290,11 @@ static int query_mem_regions(struct xe_d
+ mem_regions->mem_regions[mem_regions->num_mem_regions].total_size =
+ man->size;
+
+- if (perfmon_capable()) {
+- xe_ttm_vram_get_used(man,
+- &mem_regions->mem_regions
+- [mem_regions->num_mem_regions].used,
+- &mem_regions->mem_regions
+- [mem_regions->num_mem_regions].cpu_visible_used);
+- }
++ xe_ttm_vram_get_used(man,
++ &mem_regions->mem_regions
++ [mem_regions->num_mem_regions].used,
++ &mem_regions->mem_regions
++ [mem_regions->num_mem_regions].cpu_visible_used);
+
+ mem_regions->mem_regions[mem_regions->num_mem_regions].cpu_visible_size =
+ xe_ttm_vram_get_cpu_visible_size(man);
media-ti-j721e-csi2rx-use-devm_of_platform_populate.patch
media-ti-j721e-csi2rx-fix-source-subdev-link-creation.patch
media-lirc-fix-error-handling-in-lirc_register.patch
+drm-exynos-exynos7_drm_decon-remove-ctx-suspended.patch
+drm-panthor-fix-memory-leak-in-panthor_ioctl_group_create.patch
+drm-msm-a6xx-fix-pdc-sleep-sequence.patch
+drm-rcar-du-dsi-fix-1-2-3-lane-support.patch
+drm-nouveau-fix-bad-ret-code-in-nouveau_bo_move_prep.patch
+drm-xe-uapi-loosen-used-tracking-restriction.patch
+drm-amd-display-incorrect-mirror-cositing.patch
+drm-amd-display-enable-dynamic-dtbclk-switch.patch
+drm-amd-display-fix-unsafe-uses-of-kernel-mode-fpu.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
