From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 10:39:58 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=8e0d31f7c871fa7b989cdaa0b766e1d8b9f98a53;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: drm-amd-pm-re-enable-mc-access-after-preparemp1forunload-on-smu-v15-apus.patch drm-amdgpu-check-amdgpu_vm_bo_find-result-in-get_mapping_info.patch drm-amdgpu-gfx-fix-cleaner-shader-ib-buffer-overflow.patch drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch drm-exynos-fbdev-remove-offset-into-screen_buffer.patch drm-i915-cdclk-fix-up-cdclk_freq_decimal-without-a-full-pll-re-enable.patch drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch drm-renesas-rzg2l_mipi_dsi-move-rzg2l_mipi_dsi_set_display_timing.patch drm-rockchip-analogix_dp-add-missing-error-check-for-platform_get_resource.patch drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch drm-tidss-fix-missing-drm_bridge_add-call.patch --- diff --git a/queue-7.1/drm-amd-pm-re-enable-mc-access-after-preparemp1forunload-on-smu-v15-apus.patch b/queue-7.1/drm-amd-pm-re-enable-mc-access-after-preparemp1forunload-on-smu-v15-apus.patch new file mode 100644 index 0000000000..db9d14a392 --- /dev/null +++ b/queue-7.1/drm-amd-pm-re-enable-mc-access-after-preparemp1forunload-on-smu-v15-apus.patch @@ -0,0 +1,46 @@ +From 76589bcc73f477ef2b3b90e4fae6a7a4dfd925af Mon Sep 17 00:00:00 2001 +From: Shubhankar Milind Sardeshpande +Date: Thu, 21 May 2026 10:55:18 +0530 +Subject: drm/amd/pm: re-enable MC access after PrepareMp1ForUnload on SMU V15 APUs + +From: Shubhankar Milind Sardeshpande + +commit 76589bcc73f477ef2b3b90e4fae6a7a4dfd925af upstream. + +During smu_v15_0_0_system_features_control(), the driver sends a +PrepareMp1ForUnload message to PMFW. PMFW then performs nBIF and SYSHUB +function-level resets (FLR), disabling PCIe CFG space reset, which +clears the framebuffer enable bit to zero and disables MC (memory controller) +access from the host. + +Re-enable MC access via the nbio mc_access_enable callback right after +PrepareMp1ForUnload completes in smu_v15_0_0_system_features_control(). + +Signed-off-by: Shubhankar Milind Sardeshpande +Signed-off-by: Suresh Guttula +Signed-off-by: Alex Deucher +(cherry picked from commit 840a3c5aeae779a3bc75d7f747c3ed18b1af6507) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_0_ppt.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_0_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_0_ppt.c +@@ -227,9 +227,14 @@ static int smu_v15_0_0_system_features_c + struct amdgpu_device *adev = smu->adev; + int ret = 0; + +- if (!en && !adev->in_s0ix) ++ if (!en && !adev->in_s0ix) { + ret = smu_cmn_send_smc_msg(smu, SMU_MSG_PrepareMp1ForUnload, NULL); + ++ /* SMU resets BIF_FB_EN to zero, re-enable MC access on APUs with SMU V15 */ ++ if (!ret && adev->nbio.funcs && adev->nbio.funcs->mc_access_enable) ++ adev->nbio.funcs->mc_access_enable(adev, true); ++ } ++ + return ret; + } + diff --git a/queue-7.1/drm-amdgpu-check-amdgpu_vm_bo_find-result-in-get_mapping_info.patch b/queue-7.1/drm-amdgpu-check-amdgpu_vm_bo_find-result-in-get_mapping_info.patch new file mode 100644 index 0000000000..4fa534d913 --- /dev/null +++ b/queue-7.1/drm-amdgpu-check-amdgpu_vm_bo_find-result-in-get_mapping_info.patch @@ -0,0 +1,50 @@ +From 93475c34111916df71c63e510fc52db01351f809 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Fri, 12 Jun 2026 21:11:53 -0500 +Subject: drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO + +From: Mario Limonciello + +commit 93475c34111916df71c63e510fc52db01351f809 upstream. + +The AMDGPU_GEM_OP_GET_MAPPING_INFO path of amdgpu_gem_op_ioctl() looks +up the bo_va for the buffer object in the caller's VM via +amdgpu_vm_bo_find(), but uses the returned pointer without checking it. + +amdgpu_vm_bo_find() returns NULL when the BO has no bo_va in that VM, +which is the normal case for a BO that has never been mapped. The result +is fed straight into amdgpu_vm_bo_va_for_each_valid_mapping(), which +expands to list_for_each_entry(mapping, &(bo_va)->valids, list) and +dereferences bo_va, causing a NULL pointer dereference. + +This is reachable by any process able to issue the ioctl (render group) +simply by requesting mapping info for an unmapped BO. + +Return -ENOENT when no bo_va is found, jumping to out_exec so the +drm_exec context and GEM object reference are released. + +Fixes: 4d82724f7f2b ("drm/amdgpu: Add mapping info option for GEM_OP ioctl") +Reviewed-by: Alex Deucher +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 528b19377affc1cc7362a70a254c1dda793595f9) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +@@ -1094,6 +1094,11 @@ int amdgpu_gem_op_ioctl(struct drm_devic + * If that number is larger than the size of the array, the ioctl must + * be retried. + */ ++ if (!bo_va) { ++ r = -ENOENT; ++ goto out_exec; ++ } ++ + if (args->num_entries > INT_MAX / sizeof(*vm_entries)) { + r = -EINVAL; + goto out_exec; diff --git a/queue-7.1/drm-amdgpu-gfx-fix-cleaner-shader-ib-buffer-overflow.patch b/queue-7.1/drm-amdgpu-gfx-fix-cleaner-shader-ib-buffer-overflow.patch new file mode 100644 index 0000000000..abd938cd53 --- /dev/null +++ b/queue-7.1/drm-amdgpu-gfx-fix-cleaner-shader-ib-buffer-overflow.patch @@ -0,0 +1,70 @@ +From 3e864bf2a32a1cbdf1e0f9c5a5a4176e8575f4a3 Mon Sep 17 00:00:00 2001 +From: Asad Kamal +Date: Fri, 5 Jun 2026 23:44:08 +0800 +Subject: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow + +From: Asad Kamal + +commit 3e864bf2a32a1cbdf1e0f9c5a5a4176e8575f4a3 upstream. + +The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but +incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is +0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a +kernel page fault. + +The IB only needs to be a minimal NOP shell to schedule the job; the +cleaner shader itself is emitted on the ring via emit_cleaner_shader(). +Fill 16 dwords to match the allocation. + +v2: Use ib_size_dw variable (Lijo) + +Fixes: d361ad5d2fc0 ("drm/amdgpu: Add sysfs interface for running cleaner shader") +Suggested-by: Lijo Lazar +Signed-off-by: Asad Kamal +Reviewed-by: Lijo Lazar +Signed-off-by: Alex Deucher +(cherry picked from commit bf21af331ebf72d0935fd70c73192414a422c03a) +CC: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -1646,12 +1646,13 @@ static int amdgpu_gfx_run_cleaner_shader + struct amdgpu_device *adev = ring->adev; + struct drm_gpu_scheduler *sched = &ring->sched; + struct drm_sched_entity entity; ++ unsigned int ib_size_dw = 16; + static atomic_t counter; + struct dma_fence *f; + struct amdgpu_job *job; + struct amdgpu_ib *ib; + void *owner; +- int i, r; ++ int r; + + /* Initialize the scheduler entity */ + r = drm_sched_entity_init(&entity, DRM_SCHED_PRIORITY_NORMAL, +@@ -1669,7 +1670,7 @@ static int amdgpu_gfx_run_cleaner_shader + owner = (void *)(unsigned long)atomic_inc_return(&counter); + + r = amdgpu_job_alloc_with_ib(ring->adev, &entity, owner, +- 64, 0, &job, ++ ib_size_dw * sizeof(uint32_t), 0, &job, + AMDGPU_KERNEL_JOB_ID_CLEANER_SHADER); + if (r) + goto err; +@@ -1679,9 +1680,8 @@ static int amdgpu_gfx_run_cleaner_shader + job->run_cleaner_shader = true; + + ib = &job->ibs[0]; +- for (i = 0; i <= ring->funcs->align_mask; ++i) +- ib->ptr[i] = ring->funcs->nop; +- ib->length_dw = ring->funcs->align_mask + 1; ++ memset32(ib->ptr, ring->funcs->nop, ib_size_dw); ++ ib->length_dw = ib_size_dw; + + f = amdgpu_job_submit(job); + diff --git a/queue-7.1/drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch b/queue-7.1/drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch new file mode 100644 index 0000000000..a53020a67a --- /dev/null +++ b/queue-7.1/drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch @@ -0,0 +1,106 @@ +From 32bd35f068a3507a1b3922cd12ea2985fc58c85b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Mon, 25 May 2026 13:33:20 +0200 +Subject: drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 32bd35f068a3507a1b3922cd12ea2985fc58c85b upstream. + +UVD 4.x and older can only access MSG, FEEDBACK buffers from a +specific 256M VRAM segment that the VCPU BO is also located in. +We already modify all placements of the given BO to ensure +the BO is placed within this segment. + +Previously, it always assumed that the VCPU segment is +the first 256M of VRAM, even though under some conditions +the VCPU BO could be allocated outside this segment, +which made UVD non-functional as the BOs were +not inside the same segment as the UVD VCPU BO. + +Solve that by using the segment where the VCPU BO actually is. + +This fixes an issue with UVD failing to initialize on SI/CIK +when resizable BAR is enabled and the VCPU BO is allocated +in a different segment. + +v2: +- For other BOs, keep using the same UVD segment as before. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/3851 +Reviewed-by: Christian König +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit cbfd4d3fc2061a1ec8e9d36e65973ac3e813358a) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 33 +++++++++++++++++++++++--------- + 1 file changed, 24 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -135,7 +135,7 @@ MODULE_FIRMWARE(FIRMWARE_VEGA12); + MODULE_FIRMWARE(FIRMWARE_VEGA20); + + static void amdgpu_uvd_idle_work_handler(struct work_struct *work); +-static void amdgpu_uvd_force_into_uvd_segment(struct amdgpu_bo *abo); ++static void amdgpu_uvd_force_into_vcpu_segment(struct amdgpu_bo *abo); + + static int amdgpu_uvd_create_msg_bo_helper(struct amdgpu_device *adev, + uint32_t size, +@@ -158,7 +158,7 @@ static int amdgpu_uvd_create_msg_bo_help + amdgpu_bo_kunmap(bo); + amdgpu_bo_unpin(bo); + amdgpu_bo_placement_from_domain(bo, AMDGPU_GEM_DOMAIN_VRAM); +- amdgpu_uvd_force_into_uvd_segment(bo); ++ amdgpu_uvd_force_into_vcpu_segment(bo); + r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx); + if (r) + goto err; +@@ -545,6 +545,24 @@ void amdgpu_uvd_free_handles(struct amdg + } + } + ++static void amdgpu_uvd_force_into_vcpu_segment(struct amdgpu_bo *bo) ++{ ++ struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev); ++ struct amdgpu_bo *vcpu_bo = adev->uvd.inst[0].vcpu_bo; ++ struct amdgpu_res_cursor vcpu_cur; ++ ++ amdgpu_res_first(vcpu_bo->tbo.resource, 0, ++ amdgpu_bo_size(vcpu_bo), &vcpu_cur); ++ ++ bo->placement.num_placement = 1; ++ bo->placement.placement = &bo->placements[0]; ++ bo->placements[0].fpfn = ALIGN_DOWN(vcpu_cur.start, SZ_256M) >> PAGE_SHIFT; ++ bo->placements[0].lpfn = bo->placements[0].fpfn + (SZ_256M >> PAGE_SHIFT); ++ bo->placements[0].mem_type = vcpu_bo->tbo.resource->mem_type; ++ if (bo->placements[0].mem_type == TTM_PL_VRAM) ++ bo->placements[0].flags |= TTM_PL_FLAG_CONTIGUOUS; ++} ++ + static void amdgpu_uvd_force_into_uvd_segment(struct amdgpu_bo *abo) + { + int i; +@@ -595,13 +613,10 @@ static int amdgpu_uvd_cs_pass1(struct am + if (!ctx->parser->adev->uvd.address_64_bit) { + /* check if it's a message or feedback command */ + cmd = amdgpu_ib_get_value(ctx->ib, ctx->idx) >> 1; +- if (cmd == 0x0 || cmd == 0x3) { +- /* yes, force it into VRAM */ +- uint32_t domain = AMDGPU_GEM_DOMAIN_VRAM; +- +- amdgpu_bo_placement_from_domain(bo, domain); +- } +- amdgpu_uvd_force_into_uvd_segment(bo); ++ if (cmd == 0x0 || cmd == 0x3) ++ amdgpu_uvd_force_into_vcpu_segment(bo); ++ else ++ amdgpu_uvd_force_into_uvd_segment(bo); + + r = ttm_bo_validate(&bo->tbo, &bo->placement, &tctx); + } diff --git a/queue-7.1/drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch b/queue-7.1/drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch new file mode 100644 index 0000000000..854b05e323 --- /dev/null +++ b/queue-7.1/drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch @@ -0,0 +1,69 @@ +From 8002b744ad70055ef11ff7d0a7d685bfe8ffe6e4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Mon, 25 May 2026 13:33:19 +0200 +Subject: drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 8002b744ad70055ef11ff7d0a7d685bfe8ffe6e4 upstream. + +These UVD versions don't fully support GPUVM and are only +validated to work when their VCPU BO is placed in VRAM. + +Signed-off-by: Timur Kristóf +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 01b8dfc0660db5d6cdd62c22dc20f774a26ce853) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -188,6 +188,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev + const struct common_firmware_header *hdr; + unsigned int family_id; + int i, j, r; ++ u32 vcpu_bo_domain; + + INIT_DELAYED_WORK(&adev->uvd.idle_work, amdgpu_uvd_idle_work_handler); + +@@ -319,12 +320,20 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev + if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) + bo_size += AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8); + ++ /* UVD 5.0 and newer HW can use 64 bit addressing. */ ++ adev->uvd.address_64_bit = ++ !amdgpu_device_ip_block_version_cmp(adev, AMD_IP_BLOCK_TYPE_UVD, 5, 0); ++ ++ vcpu_bo_domain = AMDGPU_GEM_DOMAIN_VRAM; ++ if (adev->uvd.address_64_bit) ++ vcpu_bo_domain |= AMDGPU_GEM_DOMAIN_GTT; ++ + for (j = 0; j < adev->uvd.num_uvd_inst; j++) { + if (adev->uvd.harvest_config & (1 << j)) + continue; ++ + r = amdgpu_bo_create_kernel(adev, bo_size, PAGE_SIZE, +- AMDGPU_GEM_DOMAIN_VRAM | +- AMDGPU_GEM_DOMAIN_GTT, ++ vcpu_bo_domain, + &adev->uvd.inst[j].vcpu_bo, + &adev->uvd.inst[j].gpu_addr, + &adev->uvd.inst[j].cpu_addr); +@@ -339,10 +348,6 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev + adev->uvd.filp[i] = NULL; + } + +- /* from uvd v5.0 HW addressing capacity increased to 64 bits */ +- if (!amdgpu_device_ip_block_version_cmp(adev, AMD_IP_BLOCK_TYPE_UVD, 5, 0)) +- adev->uvd.address_64_bit = true; +- + r = amdgpu_uvd_create_msg_bo_helper(adev, 128 << 10, &adev->uvd.ib_bo); + if (r) + return r; diff --git a/queue-7.1/drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch b/queue-7.1/drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch new file mode 100644 index 0000000000..ebaaf1850e --- /dev/null +++ b/queue-7.1/drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch @@ -0,0 +1,90 @@ +From 2d8b08844c0ecc6f2002fa68711e779aa18c8585 Mon Sep 17 00:00:00 2001 +From: Vitor Soares +Date: Tue, 5 May 2026 14:47:05 +0100 +Subject: drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() + +From: Vitor Soares + +commit 2d8b08844c0ecc6f2002fa68711e779aa18c8585 upstream. + +The deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks +for both runtime PM and system sleep. This causes the DSI clocks to be +disabled twice: once during runtime suspend and again during system +suspend, resulting in a WARN message from the clock framework when +attempting to disable already-disabled clocks. + +[ 84.384540] clk:231:5 already disabled +[ 84.388314] WARNING: CPU: 2 PID: 531 at /drivers/clk/clk.c:1181 clk_core_disable+0xa4/0xac +... +[ 84.579183] Call trace: +[ 84.581624] clk_core_disable+0xa4/0xac +[ 84.585457] clk_disable+0x30/0x4c +[ 84.588857] cdns_dsi_suspend+0x20/0x58 [cdns_dsi] +[ 84.593651] pm_generic_suspend+0x2c/0x44 +[ 84.597661] ti_sci_pd_suspend+0xbc/0x15c +[ 84.601670] dpm_run_callback+0x8c/0x14c +[ 84.605588] __device_suspend+0x1a0/0x56c +[ 84.609594] dpm_suspend+0x17c/0x21c +[ 84.613165] dpm_suspend_start+0xa0/0xa8 +[ 84.617083] suspend_devices_and_enter+0x12c/0x634 +[ 84.621872] pm_suspend+0x1fc/0x368 + +To address this issue, replace UNIVERSAL_DEV_PM_OPS() with +RUNTIME_PM_OPS(). Bridge and panel drivers should only deal with runtime +PM, as the DRM framework manages system-wide power transitions through +the bridge enable() and disable() hooks. + +Link: https://lore.kernel.org/all/fbde0659-78f3-46e4-98cf-d832f765a18b@ideasonboard.com/ +Cc: stable@vger.kernel.org # 6.1.x +Fixes: e19233955d9e ("drm/bridge: Add Cadence DSI driver") +Reviewed-by: Tomi Valkeinen +Signed-off-by: Vitor Soares +Reviewed-by: Luca Ceresoli +Link: https://patch.msgid.link/20260505134705.188661-2-ivitro@gmail.com +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c +@@ -1230,7 +1230,7 @@ static const struct mipi_dsi_host_ops cd + .transfer = cdns_dsi_transfer, + }; + +-static int __maybe_unused cdns_dsi_resume(struct device *dev) ++static int cdns_dsi_resume(struct device *dev) + { + struct cdns_dsi *dsi = dev_get_drvdata(dev); + +@@ -1241,7 +1241,7 @@ static int __maybe_unused cdns_dsi_resum + return 0; + } + +-static int __maybe_unused cdns_dsi_suspend(struct device *dev) ++static int cdns_dsi_suspend(struct device *dev) + { + struct cdns_dsi *dsi = dev_get_drvdata(dev); + +@@ -1251,8 +1251,9 @@ static int __maybe_unused cdns_dsi_suspe + return 0; + } + +-static UNIVERSAL_DEV_PM_OPS(cdns_dsi_pm_ops, cdns_dsi_suspend, cdns_dsi_resume, +- NULL); ++static const struct dev_pm_ops cdns_dsi_pm_ops = { ++ RUNTIME_PM_OPS(cdns_dsi_suspend, cdns_dsi_resume, NULL) ++}; + + static int cdns_dsi_drm_probe(struct platform_device *pdev) + { +@@ -1399,7 +1400,7 @@ static struct platform_driver cdns_dsi_p + .driver = { + .name = "cdns-dsi", + .of_match_table = cdns_dsi_of_match, +- .pm = &cdns_dsi_pm_ops, ++ .pm = pm_ptr(&cdns_dsi_pm_ops), + }, + }; + module_platform_driver(cdns_dsi_platform_driver); diff --git a/queue-7.1/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch b/queue-7.1/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch new file mode 100644 index 0000000000..424eac49b3 --- /dev/null +++ b/queue-7.1/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch @@ -0,0 +1,67 @@ +From 55bd5e685bda455b9b50c835f8c8442d52a344a3 Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Fri, 10 Apr 2026 04:19:01 +0000 +Subject: drm/dp/mst: fix buffer overflows in sideband chunk accumulation + +From: Ashutosh Desai + +commit 55bd5e685bda455b9b50c835f8c8442d52a344a3 upstream. + +drm_dp_sideband_append_payload() has three related bugs when processing +device-provided sideband reply data: + +1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken + directly from the DP sideband header. If a device sends msg_len=0, + curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) + is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). + drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() + writes 255 bytes into msg[], both far out of bounds. + +2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is + only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks + until curchunk_idx reaches curchunk_len, writing up to 15 bytes past + the end of chunk[] into msg[]. + +3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to + msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], + so the memcpy can spill into adjacent struct fields. + +All three are reachable from any DP MST device that can forge sideband +reply messages on a physical connection. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260410041901.2438960-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -789,6 +789,12 @@ static bool drm_dp_sideband_append_paylo + { + u8 crc4; + ++ /* curchunk_len must be >= 1 (min 1 CRC byte) and fit in chunk[] */ ++ if (!msg->curchunk_len || ++ msg->curchunk_len > ARRAY_SIZE(msg->chunk) || ++ msg->curchunk_idx + replybuflen > ARRAY_SIZE(msg->chunk)) ++ return false; ++ + memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen); + msg->curchunk_idx += replybuflen; + +@@ -799,6 +805,9 @@ static bool drm_dp_sideband_append_paylo + print_hex_dump(KERN_DEBUG, "wrong crc", + DUMP_PREFIX_NONE, 16, 1, + msg->chunk, msg->curchunk_len, false); ++ /* Guard against accumulated msg[] overflow */ ++ if (msg->curlen + msg->curchunk_len - 1 > ARRAY_SIZE(msg->msg)) ++ return false; + /* copy chunk into bigger msg */ + memcpy(&msg->msg[msg->curlen], msg->chunk, msg->curchunk_len - 1); + msg->curlen += msg->curchunk_len - 1; diff --git a/queue-7.1/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch b/queue-7.1/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch new file mode 100644 index 0000000000..6708d32605 --- /dev/null +++ b/queue-7.1/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch @@ -0,0 +1,61 @@ +From 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Sun, 10 May 2026 20:17:33 +0000 +Subject: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers + +From: Ashutosh Desai + +commit 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 upstream. + +drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw +message and then unconditionally does: + + memcpy(bytes, &raw->msg[idx], num_bytes); + +without checking that idx + num_bytes <= raw->curlen. raw->msg[] is +256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger +than the remaining payload, the memcpy reads past the received data +into whatever follows in raw->msg[]. + +drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted +with a /* TODO check */ comment since the code was introduced). + +Fix both functions by using a single combined check +(idx + num_bytes > curlen) before each memcpy. Since num_bytes is u8, +it is always >= 0, so this strictly subsumes the simpler idx > curlen +form and no separate step is needed. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +[added missing fixes tag] +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260510201733.2882224-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -871,7 +871,7 @@ static bool drm_dp_sideband_parse_remote + goto fail_len; + repmsg->u.remote_dpcd_read_ack.num_bytes = raw->msg[idx]; + idx++; +- if (idx > raw->curlen) ++ if (idx + repmsg->u.remote_dpcd_read_ack.num_bytes > raw->curlen) + goto fail_len; + + memcpy(repmsg->u.remote_dpcd_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_dpcd_read_ack.num_bytes); +@@ -907,7 +907,9 @@ static bool drm_dp_sideband_parse_remote + goto fail_len; + repmsg->u.remote_i2c_read_ack.num_bytes = raw->msg[idx]; + idx++; +- /* TODO check */ ++ if (idx + repmsg->u.remote_i2c_read_ack.num_bytes > raw->curlen) ++ goto fail_len; ++ + memcpy(repmsg->u.remote_i2c_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_i2c_read_ack.num_bytes); + return true; + fail_len: diff --git a/queue-7.1/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch b/queue-7.1/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch new file mode 100644 index 0000000000..b4fbc6a607 --- /dev/null +++ b/queue-7.1/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch @@ -0,0 +1,90 @@ +From 6b89ba3dba2f583626fb693e47e951ffb8bf591f Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Sun, 10 May 2026 20:31:28 +0000 +Subject: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers + +From: Ashutosh Desai + +commit 6b89ba3dba2f583626fb693e47e951ffb8bf591f upstream. + +Three sideband reply parsers read 16-bit fields as: + + val = (raw->msg[idx] << 8) | (raw->msg[idx+1]); + +and check bounds only after the fact. When idx == raw->curlen, +raw->msg[idx+1] reads one byte past the received message data into +the following struct fields (curchunk_len, curchunk_idx, curlen). + +Affected functions: + - drm_dp_sideband_parse_enum_path_resources_ack() + full_payload_bw_number and avail_payload_bw_number fields + - drm_dp_sideband_parse_allocate_payload_ack() + allocated_pbn field + - drm_dp_sideband_parse_query_payload_ack() + allocated_pbn field + +Fix by using a single combined check (idx + 2 > curlen) before each +2-byte read. Since the check is strictly tighter than idx > curlen, +no separate step is needed. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +[added fixes tag] +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260510203128.2884846-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 ++++------------- + 1 file changed, 4 insertions(+), 13 deletions(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -934,16 +934,13 @@ static bool drm_dp_sideband_parse_enum_p + repmsg->u.path_resources.port_number = (raw->msg[idx] >> 4) & 0xf; + repmsg->u.path_resources.fec_capable = raw->msg[idx] & 0x1; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.path_resources.full_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]); + idx += 2; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.path_resources.avail_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("enum resource parse length fail %d %d\n", idx, raw->curlen); +@@ -961,12 +958,9 @@ static bool drm_dp_sideband_parse_alloca + goto fail_len; + repmsg->u.allocate_payload.vcpi = raw->msg[idx]; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.allocate_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx+1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n", idx, raw->curlen); +@@ -980,12 +974,9 @@ static bool drm_dp_sideband_parse_query_ + + repmsg->u.query_payload.port_number = (raw->msg[idx] >> 4) & 0xf; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.query_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx + 1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("query payload parse length fail %d %d\n", idx, raw->curlen); diff --git a/queue-7.1/drm-exynos-fbdev-remove-offset-into-screen_buffer.patch b/queue-7.1/drm-exynos-fbdev-remove-offset-into-screen_buffer.patch new file mode 100644 index 0000000000..44c940e46e --- /dev/null +++ b/queue-7.1/drm-exynos-fbdev-remove-offset-into-screen_buffer.patch @@ -0,0 +1,48 @@ +From 760bbc58c2c833dec0ee38dd959f4f2f4084fc57 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Mon, 11 May 2026 13:54:31 +0200 +Subject: drm/exynos: fbdev: Remove offset into screen_buffer + +From: Thomas Zimmermann + +commit 760bbc58c2c833dec0ee38dd959f4f2f4084fc57 upstream. + +The screen_buffer field in struct fb_info contains the kernel address +of the first byte of framebuffer memory. Do not add the display offset. +This offset only describes scrolling during scanout. + +Signed-off-by: Thomas Zimmermann +Fixes: 19c8b8343d9c ("drm/exynos: fixed overlay data updating.") +Tested-by: Marek Szyprowski +Acked-by: Marek Szyprowski +Signed-off-by: Inki Dae +Cc: dri-devel@lists.freedesktop.org +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-samsung-soc@vger.kernel.org +Cc: # v3.2+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/exynos/exynos_drm_fbdev.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c +@@ -61,17 +61,13 @@ static int exynos_drm_fbdev_update(struc + struct fb_info *fbi = helper->info; + struct drm_framebuffer *fb = helper->fb; + unsigned int size = fb->width * fb->height * fb->format->cpp[0]; +- unsigned long offset; + + fbi->fbops = &exynos_drm_fb_ops; + + drm_fb_helper_fill_info(fbi, helper, sizes); + +- offset = fbi->var.xoffset * fb->format->cpp[0]; +- offset += fbi->var.yoffset * fb->pitches[0]; +- + fbi->flags |= FBINFO_VIRTFB; +- fbi->screen_buffer = exynos_gem->kvaddr + offset; ++ fbi->screen_buffer = exynos_gem->kvaddr; + fbi->screen_size = size; + fbi->fix.smem_len = size; + diff --git a/queue-7.1/drm-i915-cdclk-fix-up-cdclk_freq_decimal-without-a-full-pll-re-enable.patch b/queue-7.1/drm-i915-cdclk-fix-up-cdclk_freq_decimal-without-a-full-pll-re-enable.patch new file mode 100644 index 0000000000..14a93c9d88 --- /dev/null +++ b/queue-7.1/drm-i915-cdclk-fix-up-cdclk_freq_decimal-without-a-full-pll-re-enable.patch @@ -0,0 +1,99 @@ +From 2ee8dbd880b14fb0b5115bf2353c7900aa33b95b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Fri, 12 Jun 2026 20:36:48 +0300 +Subject: drm/i915/cdclk: Fix up CDCLK_FREQ_DECIMAL without a full PLL re-enable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 2ee8dbd880b14fb0b5115bf2353c7900aa33b95b upstream. + +The GOP (and even Bspec on some platforms) is a bit inconsistent +on what the CDCLK_FREQ_DECIMAL divider should be. Currently any +mismatch there causes a full CDCLK PLL disable+re-enable, which +we really don't want to do if any displays are currently active. +Let's instead just reprogram CDCLK_FREQ_DECIMAL when that is the +only thing amiss. For any other (more serious) mismatch we still +punt to the full PLL reprogramming. + +We also need to tweak the bxt_cdclk_cd2x_pipe() stuff a bit to +consistently select pipe==NONE since we have no idea which pipes +are enabled at this point. Since we're not actually changing the +CDCLK frequency here we don't need to sync the update to any +pipe. + +Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/16209 +Signed-off-by: Ville Syrjälä +Link: https://patch.msgid.link/20260612173653.7830-2-ville.syrjala@linux.intel.com +Reviewed-by: Michał Grzelak +(cherry picked from commit 3f9de66f8acbf8ff45a91b4920605ed10c6b7c06) +Fixes: ba91b9eecb47 ("drm/i915/cdclk: Decouple cdclk from state->modeset") +Fixes: d66a21947e21 ("drm/i915/bxt: Sanitize CDCLK to fix breakage during S4 resume") +Fixes: c73666f394fc ("drm/i915/skl: If needed sanitize bios programmed cdclk") +Cc: # v4.5+ +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_cdclk.c | 41 ++++++++++++++++++++++++----- + 1 file changed, 34 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_cdclk.c ++++ b/drivers/gpu/drm/i915/display/intel_cdclk.c +@@ -1256,9 +1256,22 @@ static void skl_sanitize_cdclk(struct in + cdctl = intel_de_read(display, CDCLK_CTL); + expected = (cdctl & CDCLK_FREQ_SEL_MASK) | + skl_cdclk_decimal(display->cdclk.hw.cdclk); +- if (cdctl == expected) +- /* All well; nothing to sanitize */ +- return; ++ ++ if (cdctl != expected) { ++ cdctl &= ~CDCLK_FREQ_DECIMAL_MASK; ++ cdctl |= expected & CDCLK_FREQ_DECIMAL_MASK; ++ ++ if (cdctl != expected) ++ goto sanitize; ++ ++ drm_dbg_kms(display->drm, "Sanitizing CDCLK decimal divider (CDCLK_CTL 0x%x, expected 0x%x)\n", ++ intel_de_read(display, CDCLK_CTL), expected); ++ ++ intel_de_write(display, CDCLK_CTL, expected); ++ } ++ ++ /* All well; nothing to sanitize */ ++ return; + + sanitize: + drm_dbg_kms(display->drm, "Sanitizing cdclk programmed by pre-os\n"); +@@ -2354,11 +2367,25 @@ static void bxt_sanitize_cdclk(struct in + * (PIPE_NONE). + */ + cdctl &= ~bxt_cdclk_cd2x_pipe(display, INVALID_PIPE); +- expected &= ~bxt_cdclk_cd2x_pipe(display, INVALID_PIPE); ++ cdctl |= bxt_cdclk_cd2x_pipe(display, INVALID_PIPE); + +- if (cdctl == expected) +- /* All well; nothing to sanitize */ +- return; ++ if (cdctl != expected) { ++ if (DISPLAY_VER(display) < 20) { ++ cdctl &= ~CDCLK_FREQ_DECIMAL_MASK; ++ cdctl |= expected & CDCLK_FREQ_DECIMAL_MASK; ++ } ++ ++ if (cdctl != expected) ++ goto sanitize; ++ ++ drm_dbg_kms(display->drm, "Sanitizing CDCLK decimal divider (CDCLK_CTL 0x%x, expected 0x%x)\n", ++ intel_de_read(display, CDCLK_CTL), expected); ++ ++ intel_de_write(display, CDCLK_CTL, expected); ++ } ++ ++ /* All well; nothing to sanitize */ ++ return; + + sanitize: + drm_dbg_kms(display->drm, "Sanitizing cdclk programmed by pre-os\n"); diff --git a/queue-7.1/drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch b/queue-7.1/drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch new file mode 100644 index 0000000000..e42389df46 --- /dev/null +++ b/queue-7.1/drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch @@ -0,0 +1,134 @@ +From 9cd74f935306cd857f46686975c43383e1d95f94 Mon Sep 17 00:00:00 2001 +From: Alessio Belle +Date: Mon, 30 Mar 2026 08:56:36 +0100 +Subject: drm/imagination: Count paired job fence as dependency in prepare_job() + +From: Alessio Belle + +commit 9cd74f935306cd857f46686975c43383e1d95f94 upstream. + +The DRM scheduler's prepare_job() callback counts the remaining +non-signaled native dependencies for a job, preventing job submission +until those (plus job data and fence update) can fit in the job queue's +CCCB. + +This means checking which dependencies can be waited upon in the +firmware, i.e. whether they are backed by a UFO object, i.e. whether +their drm_sched_fence::parent has been assigned to a +pvr_queue_fence::base fence. That happens when the job owning the fence +is submitted to the firmware. + +Paired geometry and fragment jobs are submitted at the same time, which +means the dependency between them can't be checked this way before +submission. + +Update job_count_remaining_native_deps() to take into account the +dependency between paired jobs. + +This fixes cases where prepare_job() underestimated the space left in +an almost full fragment CCCB, wrongly unblocking run_job(), which then +returned early without writing the full sequence of commands to the +CCCB. + +The above lead to kernel warnings such as the following and potentially +job timeouts (depending on waiters on the missing commands): + + [ 375.702979] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#1: kworker/u16:3/47 + [ 375.703160] Modules linked in: + [ 375.703571] CPU: 1 UID: 0 PID: 47 Comm: kworker/u16:3 Tainted: G W 7.0.0-rc2-g817eb6b11ad5 #40 PREEMPT + [ 375.703613] Tainted: [W]=WARN + [ 375.703627] Hardware name: Texas Instruments AM625 SK (DT) + [ 375.703645] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched] + [ 375.703741] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + [ 375.703764] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] + [ 375.703847] lr : pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr] + [ 375.703921] sp : ffff800084a97650 + [ 375.703934] x29: ffff800084a97740 x28: 0000000000000958 x27: ffff80008565d000 + [ 375.703979] x26: 0000000000000030 x25: ffff800084a97680 x24: 0000000000001000 + [ 375.704017] x23: ffff800084a97820 x22: 1ffff00010952ecc x21: 0000000000000008 + [ 375.704056] x20: 00000000000006a8 x19: ffff00002ff7da88 x18: 0000000000000000 + [ 375.704093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000 + [ 375.704132] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 + [ 375.704168] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3 + [ 375.704206] x8 : 00000000f2f2f200 x7 : ffff700010952ecc x6 : 0000000000000008 + [ 375.704243] x5 : 0000000000000000 x4 : 1ffff00010acba00 x3 : 0000000000000000 + [ 375.704279] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f + [ 375.704317] Call trace: + [ 375.704331] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P) + [ 375.704411] pvr_queue_submit_job_to_cccb+0x578/0xa70 [powervr] + [ 375.704487] pvr_queue_run_job+0x3a4/0x990 [powervr] + [ 375.704562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched] + [ 375.704623] process_one_work+0x520/0x1288 + [ 375.704658] worker_thread+0x3f0/0xb3c + [ 375.704680] kthread+0x334/0x3d8 + [ 375.704706] ret_from_fork+0x10/0x20 + [ 375.704736] ---[ end trace 0000000000000000 ]--- + +Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling") +Cc: stable@vger.kernel.org +Signed-off-by: Alessio Belle +Reviewed-by: Brajesh Gupta +Link: https://patch.msgid.link/20260330-job-submission-fixes-cleanup-v1-1-7de8c09cef8c@imgtec.com +Signed-off-by: Matt Coster +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/imagination/pvr_queue.c | 27 +++++++++++++++++++++++---- + 1 file changed, 23 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/imagination/pvr_queue.c ++++ b/drivers/gpu/drm/imagination/pvr_queue.c +@@ -179,7 +179,7 @@ static const struct dma_fence_ops pvr_qu + + /** + * to_pvr_queue_job_fence() - Return a pvr_queue_fence object if the fence is +- * backed by a UFO. ++ * already backed by a UFO. + * @f: The dma_fence to turn into a pvr_queue_fence. + * + * Return: +@@ -356,6 +356,15 @@ static u32 job_cmds_size(struct pvr_job + pvr_cccb_get_size_of_cmd_with_hdr(job->cmd_len); + } + ++static bool ++is_paired_job_fence(struct dma_fence *fence, struct pvr_job *job) ++{ ++ /* This assumes "fence" is one of "job"'s drm_sched_job::dependencies */ ++ return job->type == DRM_PVR_JOB_TYPE_FRAGMENT && ++ job->paired_job && ++ &job->paired_job->base.s_fence->scheduled == fence; ++} ++ + /** + * job_count_remaining_native_deps() - Count the number of non-signaled native dependencies. + * @job: Job to operate on. +@@ -371,6 +380,17 @@ static unsigned long job_count_remaining + xa_for_each(&job->base.dependencies, index, fence) { + struct pvr_queue_fence *jfence; + ++ if (is_paired_job_fence(fence, job)) { ++ /* ++ * A fence between paired jobs won't resolve to a pvr_queue_fence (i.e. ++ * be backed by a UFO) until the jobs have been submitted, together. ++ * The submitting code will insert a partial render fence command for this. ++ */ ++ WARN_ON(dma_fence_is_signaled(fence)); ++ remaining_count++; ++ continue; ++ } ++ + jfence = to_pvr_queue_job_fence(fence); + if (!jfence) + continue; +@@ -630,9 +650,8 @@ static void pvr_queue_submit_job_to_cccb + if (!jfence) + continue; + +- /* Skip the partial render fence, we will place it at the end. */ +- if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job && +- &job->paired_job->base.s_fence->scheduled == fence) ++ /* This fence will be placed last, as partial render fence. */ ++ if (is_paired_job_fence(fence, job)) + continue; + + if (dma_fence_is_signaled(&jfence->base)) diff --git a/queue-7.1/drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch b/queue-7.1/drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch new file mode 100644 index 0000000000..3cadfeafcd --- /dev/null +++ b/queue-7.1/drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch @@ -0,0 +1,157 @@ +From 4baf9e70cb756d78dd56419f8baee2978a72d0c3 Mon Sep 17 00:00:00 2001 +From: Alessio Belle +Date: Mon, 30 Mar 2026 08:56:37 +0100 +Subject: drm/imagination: Fit paired fragment job in the correct CCCB + +From: Alessio Belle + +commit 4baf9e70cb756d78dd56419f8baee2978a72d0c3 upstream. + +For geometry jobs with a paired fragment job, at the moment, the +DRM scheduler's prepare_job() callback: + +- checks for internal (driver) dependencies for the geometry job; +- calls into pvr_queue_get_paired_frag_job_dep() to check for external + dependencies for the fragment job (the two jobs are submitted together + but the common scheduler code doesn't know about it, so this needs to + be done at this point in time); +- calls into the prepare_job() callback again, but for the fragment job, + to check its internal dependencies as well, passing the fragment job's + drm_sched_job and the geometry job's drm_sched_entity / pvr_queue. + +The problem with the last step is that pvr_queue_prepare_job() doesn't +always take the mismatched fragment job and geometry queue into account, +in particular when checking whether there is space for the fragment +command to be submitted, so the code ends up checking for space in the +geometry (i.e. wrong) CCCB. +The rest of the nested prepare_job() callback happens to work fine at +the moment as the other internal dependencies are not relevant for a +paired fragment job. + +Move the initialisation of a paired fragment job's done fence and CCCB +fence to pvr_queue_get_paired_frag_job_dep(), inferring the correct +queue from the fragment job itself. + +This fixes cases where prepare_job() wrongly assumed that there was +enough space for a paired fragment job in its own CCCB, unblocking +run_job(), which then returned early without writing the full sequence +of commands to the CCCB. + +The above lead to kernel warnings such as the following and potentially +job timeouts (depending on waiters on the missing commands): + + [ 552.421075] WARNING: drivers/gpu/drm/imagination/pvr_cccb.c:178 at pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr], CPU#2: kworker/u16:5/63 + [ 552.421230] Modules linked in: + [ 552.421592] CPU: 2 UID: 0 PID: 63 Comm: kworker/u16:5 Tainted: G W 7.0.0-rc2-gc5d053e4dccb #39 PREEMPT + [ 552.421625] Tainted: [W]=WARN + [ 552.421637] Hardware name: Texas Instruments AM625 SK (DT) + [ 552.421655] Workqueue: powervr-sched drm_sched_run_job_work [gpu_sched] + [ 552.421744] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + [ 552.421766] pc : pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] + [ 552.421850] lr : pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr] + [ 552.421923] sp : ffff800084c47650 + [ 552.421936] x29: ffff800084c47740 x28: 0000000000000df8 x27: ffff800088a77000 + [ 552.421979] x26: 0000000000000030 x25: ffff800084c47680 x24: 0000000000001000 + [ 552.422017] x23: ffff800084c47820 x22: 1ffff00010988ecc x21: 0000000000000008 + [ 552.422055] x20: 0000000000000208 x19: ffff000006ad5a88 x18: 0000000000000000 + [ 552.422093] x17: 0000000020020000 x16: 0000000000020000 x15: 0000000000000000 + [ 552.422130] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 + [ 552.422167] x11: 000000000000f2f2 x10: 00000000f3000000 x9 : 00000000f3f3f3f3 + [ 552.422204] x8 : 00000000f2f2f200 x7 : ffff700010988ecc x6 : 0000000000000008 + [ 552.422241] x5 : 0000000000000000 x4 : 1ffff0001114ee00 x3 : 0000000000000000 + [ 552.422278] x2 : 0000000000000007 x1 : 0000000000000fff x0 : 000000000000002f + [ 552.422316] Call trace: + [ 552.422330] pvr_cccb_write_command_with_header+0x2c4/0x330 [powervr] (P) + [ 552.422411] pvr_queue_submit_job_to_cccb+0x57c/0xa74 [powervr] + [ 552.422486] pvr_queue_run_job+0x3a4/0x990 [powervr] + [ 552.422562] drm_sched_run_job_work+0x580/0xd48 [gpu_sched] + [ 552.422623] process_one_work+0x520/0x1288 + [ 552.422657] worker_thread+0x3f0/0xb3c + [ 552.422679] kthread+0x334/0x3d8 + [ 552.422706] ret_from_fork+0x10/0x20 + +Fixes: eaf01ee5ba28 ("drm/imagination: Implement job submission and scheduling") +Cc: stable@vger.kernel.org +Signed-off-by: Alessio Belle +Reviewed-by: Brajesh Gupta +Link: https://patch.msgid.link/20260330-job-submission-fixes-cleanup-v1-2-7de8c09cef8c@imgtec.com +Signed-off-by: Matt Coster +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/imagination/pvr_queue.c | 32 ++++++++++++++------------------ + 1 file changed, 14 insertions(+), 18 deletions(-) + +--- a/drivers/gpu/drm/imagination/pvr_queue.c ++++ b/drivers/gpu/drm/imagination/pvr_queue.c +@@ -488,10 +488,11 @@ pvr_queue_get_job_kccb_fence(struct pvr_ + } + + static struct dma_fence * +-pvr_queue_get_paired_frag_job_dep(struct pvr_queue *queue, struct pvr_job *job) ++pvr_queue_get_paired_frag_job_dep(struct pvr_job *job) + { + struct pvr_job *frag_job = job->type == DRM_PVR_JOB_TYPE_GEOMETRY ? + job->paired_job : NULL; ++ struct pvr_queue *frag_queue = frag_job ? frag_job->ctx->queues.fragment : NULL; + struct dma_fence *f; + unsigned long index; + +@@ -510,7 +511,10 @@ pvr_queue_get_paired_frag_job_dep(struct + return dma_fence_get(f); + } + +- return frag_job->base.sched->ops->prepare_job(&frag_job->base, &queue->entity); ++ /* Initialize the paired fragment job's done_fence, so we can signal it. */ ++ pvr_queue_job_fence_init(frag_job->done_fence, frag_queue); ++ ++ return pvr_queue_get_job_cccb_fence(frag_queue, frag_job); + } + + /** +@@ -529,11 +533,6 @@ pvr_queue_prepare_job(struct drm_sched_j + struct pvr_queue *queue = container_of(s_entity, struct pvr_queue, entity); + struct dma_fence *internal_dep = NULL; + +- /* +- * Initialize the done_fence, so we can signal it. This must be done +- * here because otherwise by the time of run_job() the job will end up +- * in the pending list without a valid fence. +- */ + if (job->type == DRM_PVR_JOB_TYPE_FRAGMENT && job->paired_job) { + /* + * This will be called on a paired fragment job after being +@@ -543,18 +542,15 @@ pvr_queue_prepare_job(struct drm_sched_j + */ + if (job->paired_job->has_pm_ref) + return NULL; +- +- /* +- * In this case we need to use the job's own ctx to initialise +- * the done_fence. The other steps are done in the ctx of the +- * paired geometry job. +- */ +- pvr_queue_job_fence_init(job->done_fence, +- job->ctx->queues.fragment); +- } else { +- pvr_queue_job_fence_init(job->done_fence, queue); + } + ++ /* ++ * Initialize the done_fence, so we can signal it. This must be done ++ * here because otherwise by the time of run_job() the job will end up ++ * in the pending list without a valid fence. ++ */ ++ pvr_queue_job_fence_init(job->done_fence, queue); ++ + /* CCCB fence is used to make sure we have enough space in the CCCB to + * submit our commands. + */ +@@ -575,7 +571,7 @@ pvr_queue_prepare_job(struct drm_sched_j + + /* The paired job fence should come last, when everything else is ready. */ + if (!internal_dep) +- internal_dep = pvr_queue_get_paired_frag_job_dep(queue, job); ++ internal_dep = pvr_queue_get_paired_frag_job_dep(job); + + return internal_dep; + } diff --git a/queue-7.1/drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch b/queue-7.1/drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch new file mode 100644 index 0000000000..e22d997320 --- /dev/null +++ b/queue-7.1/drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch @@ -0,0 +1,36 @@ +From 7cbba8a8ba0219a267844d3116dbc77cecb4fcf8 Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Mon, 30 Mar 2026 11:44:45 +0100 +Subject: drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay + +From: Biju Das + +commit 7cbba8a8ba0219a267844d3116dbc77cecb4fcf8 upstream. + +The RZ/G2L hardware manual (Rev. 1.50, May 2025), Section 34.4.2.1, +requires waiting at least 1 msec after deasserting the CMN_RSTB signal +before the DSI-Tx module is ready. Increase the delay from 1 usec to +1 msec by replacing udelay(1) with fsleep(1000) for RZ/G2L SoCs. + +Fixes: 7a043f978ed1 ("drm: rcar-du: Add RZ/G2L DSI driver") +Cc: stable@vger.kernel.org +Reviewed-by: Tommaso Merciai +Tested-by: Tommaso Merciai +Link: https://patch.msgid.link/20260330104450.128512-3-biju.das.jz@bp.renesas.com +Signed-off-by: Biju Das +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c ++++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c +@@ -528,7 +528,7 @@ static int rzg2l_mipi_dsi_dphy_init(stru + if (ret < 0) + return ret; + +- udelay(1); ++ fsleep(1000); + + return 0; + } diff --git a/queue-7.1/drm-renesas-rzg2l_mipi_dsi-move-rzg2l_mipi_dsi_set_display_timing.patch b/queue-7.1/drm-renesas-rzg2l_mipi_dsi-move-rzg2l_mipi_dsi_set_display_timing.patch new file mode 100644 index 0000000000..d1a8e45cfd --- /dev/null +++ b/queue-7.1/drm-renesas-rzg2l_mipi_dsi-move-rzg2l_mipi_dsi_set_display_timing.patch @@ -0,0 +1,70 @@ +From 5bfa858d53bb252d7a012c2e0a97ae18182edfb1 Mon Sep 17 00:00:00 2001 +From: Biju Das +Date: Mon, 30 Mar 2026 11:44:44 +0100 +Subject: drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing() + +From: Biju Das + +commit 5bfa858d53bb252d7a012c2e0a97ae18182edfb1 upstream. + +The RZ/G2L hardware manual (Rev. 1.50, May 2025), Section 34.4.2.1, +requires display timings to be set after the HS clock is started. Move +rzg2l_mipi_dsi_set_display_timing() from +rzg2l_mipi_dsi_atomic_pre_enable() to rzg2l_mipi_dsi_atomic_enable(), +placing it after rzg2l_mipi_dsi_start_hs_clock(). Drop the unused ret +variable from rzg2l_mipi_dsi_atomic_pre_enable(). + +Fixes: 5ce16c169a4c ("drm: renesas: rz-du: Add atomic_pre_enable") +Fixes: 7a043f978ed1 ("drm: rcar-du: Add RZ/G2L DSI driver") +Cc: stable@vger.kernel.org +Reviewed-by: Tommaso Merciai +Tested-by: Tommaso Merciai +Link: https://patch.msgid.link/20260330104450.128512-2-biju.das.jz@bp.renesas.com +Signed-off-by: Biju Das +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c ++++ b/drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c +@@ -1025,29 +1025,33 @@ static void rzg2l_mipi_dsi_atomic_pre_en + const struct drm_display_mode *mode; + struct drm_connector *connector; + struct drm_crtc *crtc; +- int ret; + + connector = drm_atomic_get_new_connector_for_encoder(state, bridge->encoder); + crtc = drm_atomic_get_new_connector_state(state, connector)->crtc; + mode = &drm_atomic_get_new_crtc_state(state, crtc)->adjusted_mode; + +- ret = rzg2l_mipi_dsi_startup(dsi, mode); +- if (ret < 0) +- return; +- +- rzg2l_mipi_dsi_set_display_timing(dsi, mode); ++ rzg2l_mipi_dsi_startup(dsi, mode); + } + + static void rzg2l_mipi_dsi_atomic_enable(struct drm_bridge *bridge, + struct drm_atomic_state *state) + { + struct rzg2l_mipi_dsi *dsi = bridge_to_rzg2l_mipi_dsi(bridge); ++ const struct drm_display_mode *mode; ++ struct drm_connector *connector; ++ struct drm_crtc *crtc; + int ret; + + ret = rzg2l_mipi_dsi_start_hs_clock(dsi); + if (ret < 0) + goto err_stop; + ++ connector = drm_atomic_get_new_connector_for_encoder(state, bridge->encoder); ++ crtc = drm_atomic_get_new_connector_state(state, connector)->crtc; ++ mode = &drm_atomic_get_new_crtc_state(state, crtc)->adjusted_mode; ++ ++ rzg2l_mipi_dsi_set_display_timing(dsi, mode); ++ + ret = rzg2l_mipi_dsi_start_video(dsi); + if (ret < 0) + goto err_stop_clock; diff --git a/queue-7.1/drm-rockchip-analogix_dp-add-missing-error-check-for-platform_get_resource.patch b/queue-7.1/drm-rockchip-analogix_dp-add-missing-error-check-for-platform_get_resource.patch new file mode 100644 index 0000000000..f7525e23de --- /dev/null +++ b/queue-7.1/drm-rockchip-analogix_dp-add-missing-error-check-for-platform_get_resource.patch @@ -0,0 +1,34 @@ +From 45895f4d4d5f222d07412f90664f88b059627859 Mon Sep 17 00:00:00 2001 +From: Chen Ni +Date: Mon, 9 Feb 2026 11:31:23 +0800 +Subject: drm/rockchip: analogix_dp: Add missing error check for platform_get_resource() + +From: Chen Ni + +commit 45895f4d4d5f222d07412f90664f88b059627859 upstream. + +Add missing error check for platform_get_resource() return value to +prevent NULL pointer dereference when memory resource is not available. + +Fixes: 718b3bb9c0ab ("drm/rockchip: analogix_dp: Expand device data to support multiple edp display") +Cc: stable@vger.kernel.org +Signed-off-by: Chen Ni +Reviewed-by: Dragan Simic +Signed-off-by: Heiko Stuebner +Link: https://patch.msgid.link/20260209033123.1089370-1-nichen@iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c ++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c +@@ -461,6 +461,8 @@ static int rockchip_dp_probe(struct plat + return -ENOMEM; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!res) ++ return -EINVAL; + + i = 0; + while (dp_data[i].reg) { diff --git a/queue-7.1/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch b/queue-7.1/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch new file mode 100644 index 0000000000..e1ca17c996 --- /dev/null +++ b/queue-7.1/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch @@ -0,0 +1,38 @@ +From 46c31e1604d121221167cb09380de8c7d53290b9 Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Fri, 30 Jan 2026 23:35:42 +0300 +Subject: drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() + +From: Sergey Shtylyov + +commit 46c31e1604d121221167cb09380de8c7d53290b9 upstream. + +The result of cdn_dp_reg_write() is checked everywhere (with the error +being logged by the callers) except one place in cdn_dp_config_video(). +Add the missing result check, bailing out early on error... + +Found by Linux Verification Center (linuxtesting.org) with the Svace static +analysis tool. + +Fixes: 1a0f7ed3abe2 ("drm/rockchip: cdn-dp: add cdn DP support for rk3399") +Signed-off-by: Sergey Shtylyov +Cc: stable@vger.kernel.org +Reviewed-by: Chaoyi Chen +Signed-off-by: Heiko Stuebner +Link: https://patch.msgid.link/adf6b313-f7db-4d8f-9000-8c65446ba041@auroraos.dev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c +@@ -685,6 +685,8 @@ int cdn_dp_config_video(struct cdn_dp_de + val = div_u64(8 * (symbol + 1), bit_per_pix) - val; + val += 2; + ret = cdn_dp_reg_write(dp, DP_VC_TABLE(15), val); ++ if (ret) ++ goto err_config_video; + + switch (video->color_depth) { + case 6: diff --git a/queue-7.1/drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch b/queue-7.1/drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch new file mode 100644 index 0000000000..503cc2defd --- /dev/null +++ b/queue-7.1/drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch @@ -0,0 +1,57 @@ +From a18b6e30ecd69096beda4a0c96d2570900c3879a Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Tue, 21 Apr 2026 09:29:06 +0200 +Subject: drm/tegra: fbdev: Remove offset into framebuffer memory + +From: Thomas Zimmermann + +commit a18b6e30ecd69096beda4a0c96d2570900c3879a upstream. + +The screen_buffer field in struct fb_info contains the kernel address +of the first byte of framebuffer memory. Do not add the display offset. +This offset only describes scrolling during scanout. + +Signed-off-by: Thomas Zimmermann +Fixes: de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb") +Cc: dri-devel@lists.freedesktop.org +Cc: linux-tegra@vger.kernel.org +Cc: # v3.10+ +Signed-off-by: Thierry Reding +Link: https://patch.msgid.link/20260421073646.144712-3-tzimmermann@suse.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tegra/fbdev.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/tegra/fbdev.c ++++ b/drivers/gpu/drm/tegra/fbdev.c +@@ -76,7 +76,6 @@ int tegra_fbdev_driver_fbdev_probe(struc + struct fb_info *info = helper->info; + unsigned int bytes_per_pixel; + struct drm_framebuffer *fb; +- unsigned long offset; + struct tegra_bo *bo; + size_t size; + int err; +@@ -115,9 +114,6 @@ int tegra_fbdev_driver_fbdev_probe(struc + + drm_fb_helper_fill_info(info, helper, sizes); + +- offset = info->var.xoffset * bytes_per_pixel + +- info->var.yoffset * fb->pitches[0]; +- + if (bo->pages) { + bo->vaddr = vmap(bo->pages, bo->num_pages, VM_MAP, + pgprot_writecombine(PAGE_KERNEL)); +@@ -129,9 +125,9 @@ int tegra_fbdev_driver_fbdev_probe(struc + } + + info->flags |= FBINFO_VIRTFB; +- info->screen_buffer = bo->vaddr + offset; ++ info->screen_buffer = bo->vaddr; + info->screen_size = size; +- info->fix.smem_start = (unsigned long)(bo->iova + offset); ++ info->fix.smem_start = (unsigned long)(bo->iova); + info->fix.smem_len = size; + + return 0; diff --git a/queue-7.1/drm-tidss-fix-missing-drm_bridge_add-call.patch b/queue-7.1/drm-tidss-fix-missing-drm_bridge_add-call.patch new file mode 100644 index 0000000000..f9b5a1ff45 --- /dev/null +++ b/queue-7.1/drm-tidss-fix-missing-drm_bridge_add-call.patch @@ -0,0 +1,63 @@ +From 83084bb36847cbd2b13743f7333aaca12613a72b Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Wed, 11 Mar 2026 11:14:44 +0200 +Subject: drm/tidss: Fix missing drm_bridge_add() call + +From: Tomi Valkeinen + +commit 83084bb36847cbd2b13743f7333aaca12613a72b upstream. + +tidss encoder-bridge is not added with drm_bridge_add() call, which +leads to: + +[drm] Missing drm_bridge_add() before attach + +Add the missing call, using devm_drm_bridge_add() variant to get the +drm_bridge_remove() handled automatically. + +The commit marked with the Fixes tag (from v6.6) is the commit that +added the encoder bridge without drm_bridge_add(). However, this fix is +not directly applicable there as devm_drm_bridge_alloc() was not used to +alloc the bridge, so using devm version for drm_bridge_add() wouldn't be +safe. Instead, drm_bridge_add() and drm_bridge_remove() would be needed +there, but that would require new plumbing code as we don't have a +separate cleanup function in the tidss_encoder.c, not in the tidss_kms.c +from which the encoder is created. + +Also, there has been no reported bugs caused by the missing +drm_bridge_add(). The drm_bridge_add() initializes the bridge's +hpd_mutex, but HPD is not used for the encoder bridge. drm_bridge_add() +also adds the bridge to the global bridge_list, which is only used in +of_drm_find_bridge(), and again that is not used for the encoder bridge. + +Thus, while the original commit is not right, there should be no bugs +caused by it, and for the time being I'm not sending a patch for the +stable kernels for the original commit. + +This fix applies on top of commit 66cdf05f8548 ("drm/tidss: encoder: +convert to devm_drm_bridge_alloc()"), which changes the tidss_encoder.c +to use the devm variant (added in v6.17). The warning print was added in +v6.19, so applying this fix to v6.17+ gets rid of the warning for all +kernel versions. + +Cc: stable@vger.kernel.org # v6.17+ +Fixes: c932ced6b585 ("drm/tidss: Update encoder/bridge chain connect model") +Acked-by: Maxime Ripard +Link: https://patch.msgid.link/20260311-tidss-minor-fixes-v2-2-cb4479784458@ideasonboard.com +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tidss/tidss_encoder.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/tidss/tidss_encoder.c ++++ b/drivers/gpu/drm/tidss/tidss_encoder.c +@@ -106,6 +106,8 @@ int tidss_encoder_create(struct tidss_de + enc = &t_enc->encoder; + enc->possible_crtcs = possible_crtcs; + ++ devm_drm_bridge_add(tidss->dev, &t_enc->bridge); ++ + /* Attaching first bridge to the encoder */ + ret = drm_bridge_attach(enc, &t_enc->bridge, NULL, + DRM_BRIDGE_ATTACH_NO_CONNECTOR); diff --git a/queue-7.1/series b/queue-7.1/series index 8f349c52d5..c9542bb021 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -359,3 +359,22 @@ pidfs-make-pidfs_ino_lock-static.patch loongarch-bpf-fix-memory-leak-in-bpf_jit_free.patch bpf-sockmap-fix-cork-use-after-free-in-tcp_bpf_sendm.patch tracing-fix-use-after-free-freeing-trigger-private-d.patch +drm-renesas-rzg2l_mipi_dsi-increase-reset-deassertion-delay.patch +drm-renesas-rzg2l_mipi_dsi-move-rzg2l_mipi_dsi_set_display_timing.patch +drm-tidss-fix-missing-drm_bridge_add-call.patch +drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch +drm-rockchip-analogix_dp-add-missing-error-check-for-platform_get_resource.patch +drm-imagination-count-paired-job-fence-as-dependency-in-prepare_job.patch +drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch +drm-exynos-fbdev-remove-offset-into-screen_buffer.patch +drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch +drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch +drm-tegra-fbdev-remove-offset-into-framebuffer-memory.patch +drm-imagination-fit-paired-fragment-job-in-the-correct-cccb.patch +drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch +drm-i915-cdclk-fix-up-cdclk_freq_decimal-without-a-full-pll-re-enable.patch +drm-amd-pm-re-enable-mc-access-after-preparemp1forunload-on-smu-v15-apus.patch +drm-amdgpu-gfx-fix-cleaner-shader-ib-buffer-overflow.patch +drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch +drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch +drm-amdgpu-check-amdgpu_vm_bo_find-result-in-get_mapping_info.patch