Commit Graph

807 Commits

Author SHA1 Message Date
Linus Torvalds
ed02f4f7ad for-7.4/io_uring-dmabuf-20261023
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrbkFsQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpiHpD/9MdThoGJTZ3mKgaZPd7lOgkxWL51CY/ULB
 X9zzyfHP9hpXxwXqpSGm8XhN7cmSDXGaCYvhVPS2YQQv0458s1UGMWDi8PJNulFS
 6M8ng6Hex2z/Uq+u6vMkruz+hH76c3ajo6kGOhJnWye+/Rq1bqqFcYBWMpLBE/yj
 lp8JGG92HyMnsIo5gzBHbUoNEc+X0+jz88mk0JRZoONJD4cNb1S1bW5v+uAk0Nvc
 /qPE9AXU2DnngvbzhfKGza/4Lkx9WKBXFmxJSiG9ZH6GJn3yndBNBi7RAODku+/E
 i+SiukHPDhn3M5cWZuJ8ilTpVWRCnnsbhavM1PN2tvcW6IfZrAz+m321+JVkzKu0
 cLUDvmz2WS0+PcodXGn3KcGVYt7vAjtQVZwZLbq2012u5xSvZN/VaeiVDIRr1uC/
 hQPiD51ZpsTt/2lAyrFGmLBsskNWc0Xhd6ePX7euNCdhfHj5UuWKcXUiQeeGiUvT
 X2JyQAJSY9VZ6eO02w77bta0II+3SSnZlA6xVmE3+Nwv2z6qr3b31gcfMIiap3Tu
 jUkKvDuB9Dw9hhgLr1t6BCuaPS3ktyd1F3dBvbs8YXyyeworU2KGtSF7mraJxts8
 GCH+DOAR1j29qMi4/bjhxOKQYAKzhWbptCiJgyReL6V+uFO6JxAeWn3qn36mjezp
 BuHNTX1A5g==
 =hlkK
 -----END PGP SIGNATURE-----

Merge tag 'for-7.4/io_uring-dmabuf-20261023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring dma-buf support from Jens Axboe:
 "This adds native dma-buf support to the I/O path, exposed through
  io_uring. It's been in development for a while and should be ready to
  go now.

   - dma-buf file I/O infrastructure: a dma_buf_io_ctx created through a
     new ->init_dma_buf_io_ctx file operation, and a dma_buf_io_map
     holding the device DMA mapping. The two are split so a mapping can
     be invalidated and re-established underneath a live context, with
     the map counting in-flight requests so it can be torn down safely.

   - A new iov_iter type for dmabuf maps, and a dma map backed bio type
     for the block layer, with raw block device support on top.

   - nvme-pci backend implementing dma-buf backed requests, including
     SGL support.

   - io_uring dmabuf backed registered buffers, built on a reworked
     buffer registration structure with an extended update path, regbuf
     import flags, an uncloneable flag for buffer types that can't be
     cloned, and cloning support for registered dma-bufs"

* tag 'for-7.4/io_uring-dmabuf-20261023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/dma-buf: don't fail fixed buffers without dma-buf support
  nvme-pci: detach dma-bufs only on removal
  block: reject dma-bufs larger than 4GiB
  io_uring/dma-buf: allow cloning registered dma-bufs
  dma-buf-io: document dma_buf_io_init_map
  dma-buf-io: fix typos in kernel docs
  block: fix indention for dma-buf checks
  io_uring/rsrc: add dmabuf backed registered buffers
  io_uring/rsrc: add regbuf import flags
  io_uring/rsrc: add uncloneable regbuf flag
  io_uring/rsrc: extend buffer update
  io_uring/rsrc: introduce buf registration structure
  nvme-pci: add SGL support for the dmabuf path
  nvme-pci: implement dma-buf backed requests
  nvme-pci: rename nvme_pci_sgl_set_data to nvme_pci_dma_iter_set_sgl
  block: add dma-buf support for raw bdev
  block: introduce dma map backed bio type
  block: always adjust bi_offset on bio_advance_iter
  iov_iter: add iterator type for dmabuf maps
  dma-buf: introduce initial file I/O infrastructure
2026-10-27 07:46:05 -10:00
Linus Torvalds
5b0764a532 drm next for 7.4-rc1
rust:
 - I/O tree shared with driver-core
 - DMA tree shared with driver-core
 - allow aux registration data closures to return covariant
   sub-fields
 - Implement Send and Sync for MapleTree
 - add pci resource flags and IORESOURCE_MEM_64
 
 drm/rust:
 - add dma_fence abstraction
 - init DRM registrations and their data in place
 - drop unused flags argument to registration
 
 vgaarb:
 - rework API to pass a private ptr instead of pci device
 sound:
 - adapt to omapdrm changes
 
 gem:
 - add callback for handle count going to 0
 
 gpusvm:
 - share one HMM fault and keep single mappings inline
 
 pagemap:
 - Prevent CPU stalls during unbounded pagemap teardown
 
 dma-fence:
 - fix docs
 
 vga_switcheroo:
 - disconnect from fbcon
 - update fbcon from within fbdev emulation
 
 atomic:
 - move DRM from state reset callbacks to atomic_create_state
 - remove drm_simple_encoder_init
 
 panic:
 - split into core and helpers
 
 buddy:
 - improve dirty tracking
 
 clients:
 - improve vmap handling
 - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko
 
 display:
 - export HDMI SCDC status data via debugfs
 - rework SCDC for better HDMI 2.0 support
 - dp/mst: improve DPCD compliance
 
 edid:
 - parse AMD VSDB
 - parse ALLM/VRR capabilities
 - support detecting panel size
 
 log:
 - add drm_warn_ratelimited
 
 sched:
 - cleanup interface
 - add missing locking
 - fix run-queue cleanup
 - fix locking
 
 sysfb:
 - remove obsolete quirk for Lenovo D330
 - fix panel orientation for non-native display modes
 - drop drm_class_device_register
 
 colorop:
 - provide DRM_COLOR_OP_FIXED_MATRIX
 
 bridge:
 - analogix: Support eDP lane mapping
 - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84
 - Select DRM_PANEL_BRIDGE for various drivers that require it
 - add chrontel ch7218a support
 
 panel:
 - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
 - samsung-s6d16d0: Use mipi_dsi_*_multi() functions
 - support Ilitek ILI7836A OLED plus DT bindings
 - support Novatek NT36532 plus DT bindings
 - convert several drivers to managed cleanup
 - fix Kconfig selections
 - edp: Add support for BOE NV140FHM-T0A
 - samsung: Share test-key helpers
 - edp: Support CSOT MNE007QB1-1
 - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization
 - edp: NV140WU2-M70
 - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings
 - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE
   DV215FHM-R01 plus DT bindings
 - Refactor struct drm_panel to contain struct drm_bridge plus fallout in
   various panel drivers
 - Add support for BOE Novatek NT51021, Retroid Pocket 6,
   Raydium RM69220 DDIC panels, Sharp LQ138P1JX61 eDP,
   BOE NV140FHD-N43, AUO B140HAN04.0, AUO 0x0db3,
   panels.
 
 amdgpu:
 - use AMD VSDB for freesync
 - implement YUV-to-RGB with fixed-matrix colorop
 - enable FRL for HDMI
 - HDMI 2.1 freesync support
 - HDMI 2.1 ALLM support
 - HDMI 2.1 VRR support
 - UALoE (UALink over Ethernet) support
 - add syncobj_points to userq signal ioctl
 - drop unused kunit tests
 - NBIO/GC/MMHUB/SMU updates/fixes
 - GPU spatial partitioning updates
 - display kunit fixes
 - userq fixes
 - RGB quantization fixes
 - DC RMCM refactor
 - DP MST fixes
 - USB4 fixes
 - add new trace events
 - Rework display instance handling
 - stack frame size fixes for various compilers/configs
 - VCN 4/5 reset fixes
 - freesync updates
 - cursor refactor
 - Fix direct scanout alpha on some DRM_FORMATs
 - Expand Mac reserved memory workaround
 - Make runtime pm more fine grained
 
 amdkfd:
 - updates and fixes
 - GC 10 CU occupancy support
 
 radeon:
 - eDP fix for DCE3.2 iMacs
 
 xe:
 - add drm_ras netlink error event support
 - add memory page offlining support
 - introduce error threshold to drm_ras
 - fix stale GTT mappings on unmap
 - reject page faults for non-page fault mode scratch VM
 - enable CRI package and VRAM temperatures
 - introduce cold reset recovery
 - handle CRI+ power interval encoding
 - VF migration for multi-queue
 - handle exec queue teardown after hot unplug
 - alerts and controller enabling modifications
 - use IBCv3 on PTL
 - VRAM health check
 - report GT TDR and VM rebind faults using SIGID
 - add multi_queue_active_lrca debugfs
 - shrinker: Runtime PM reference for non-system memory
 - guc: Add simple KLV decoder helpers
 - debugfs: Expose per-engine idle status
 - Keep walking on SVM eviction failure
 - Nuke PTs only after unlinking contested VMAs
 - limit sg segment size to PAGE_SIZE on Xen PV
 - keep VF LMEM bar size low if no VFs
 - CPU binds and ULLS on migration queue
 - New PTL PCI ID
 - Enable PXP for NVL-S
 - Do not dma_fence_put zero fences in err_out path
 - Refresh TTM LRU on SVM prefetch
 - export device UID in sysfs
 
 i915:
 - rename GEN6_PCODE_DATA to match spec
 - fix incorrect RCU teardown order
 - fix potential UAF in command parsing
 - avoid WARN splat during RPS boosting race
 - use simpler min functions
 - Fixes to make i915 work well with PREEMPT_RT
 
 i915/display:
 - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path
 - Switch DG2 MPLL to DPLL framework
 - DP-HDMI PCON DSC fixes
 - limit invalid joiner combinations
 - CDCLK related fixes and refactor around PCODE integration
 - Gate UHBR SST SDP splitting on sink caps
 - add HDMI TMDS audio bandwidth check
 - vswing/preemph override
 - enable AS SDP Skip frames
 - Handle negative configuration index on DP link caps for robustness
 - Preparation for enabling SDR plane color pipeline
 - An eDP quirk for HP Pavilion Plus
 - Introduce PME (Power Management Event) support on display hotplug
 - Handle VSC SDP revision 7 in unpack
 
 msm:
 - CI:
   - Dropped sc7180 trogdor lazor from the CI
 - Core:
   - Fixed msm_ioremap for resources without a name
   - Changed msm.separate_gpu_kms to default to auto selection
 - GPU:
   - Enable CLX (Current Limit eXtension) for gen8 to avoid
     exceeding limits on CX/GX rails
   - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi),
     x2-85 (Mahua)
   - Fix VBIF halt mask on a306, which was preventing runpm
     suspend
   - Enable THP support for GEM buffers
   - Add modparam to disable waiting on fences in shrinker
   - Drop use of drm_prime_sg_to_page_array()
   - a5xx: don't read the GPMU registers on GPUs without a GPMU
   - a2xx/a3xx/a5xx: hangcheck progress detection
   - a6xx: gmuwrapper runpm fix
   - Calculate reported GMEM size based on active slices
   - Split a6xx/a7xx/a8xx catalog
 - DP:
   - Picked up some preparation patches for the MST support
   - Fixed reported status of the link training
 - DPU:
   - Fixed CRTC bandwidth computation
   - Fixed DSC programming
   - Fixed encoder disablement path
 - DSI:
   - Fixed VM leak in error path
   - Indention fix
 - MDP5:
   - Added MSM8952 configuration
   - Dropped incorrect cursor pipe on MSM8976/56
 - HDMI:
   - Small fixes
 
 nouveau:
 - improve runtime PM on R570 GSP firmware
 - various fixes throughout the driver
 - dispnv50: support 2.147 GHz pixel clock in GB20x
 
 nova:
 - add initial uapi concept
 - add initial PRAMIN access support
 - add GpuMm centralized memory manager
 - add GPU VM and BAR1 support
 - add GPU interrupts and GSP events support
 - GSP messaging fixes
 
 tyr:
 - use bitfield!
 - zero unsupported and newly added GPU info fields
 - limit doorbell array to 17 entries
 
 exynos:
 - FIMD fixes
   - Fix clock leak on resume error path.
   - Fix Sparse warnings by adding missing __iomem annotation.
 - VIDI cleanup
   - Replace kmalloc() and copy_from_user() with memdup_user().
 
 amdxdna:
 - fix BO handling
 - Support AIE2 rev 9
 - Fix UAF access in scheduler fences
 - Update workqueue interface
 - expose busy time via fdinfo
 
 ast:
 - support 256-byte EDID
 
 hyperv_drm:
 - remove support for pre win10 hosts
 
 komeda:
 - fix GLB_CORE_ID usage
 
 omap:
 - report HDMI hotplug events to ASoC HDMI codec
 
 panthor:
 - provide gpu_cache_flush tracepoint
 - improve dma_fence signalling latency
 - improve locking
 - export scheduling information via debugfs
 - Validate user-space input against firmware limits
 
 qaic:
 - reject BOs that exceed maximum page count
 - add missing include statements
 
 verisilicon:
 - fix hardware cursor offsets
 
 vkms:
 - implement YUV-to-RGB with fixed-matrix colorop
 
 gma500:
 - avoid unsupported ARGB formats in primary plane
 
 hibmc:
 - handle vblank interrupts correctly
 
 ivpu:
 - add DRM_IVPU_CAP_CMDQ_SET_PRIORITY
 - support command-queue priority ioctl
 - Simplify NULL-pointer handling in cleanup code
 
 arcpgu:
 - replace simple-display pipeline with regular atomic helpers
 
 aspeed:
 - replace simple-display pipeline with regular atomic helpers
 
 gm12u320:
 - replace simple-display pipeline with regular atomic helpers
 
 imagination:
 - various improvement to firmware interaction
 - add job to pvr_job_submit_fw trace event
 
 mali-dp:
 - fix runtime PM leak
 
 mcde:
 - replace simple-display pipeline with regular atomic helpers
 
 p111:
 - replace simple-display pipeline with regular atomic helpers
 - drop unsupported alpha formats from primary plane
 
 rcar-du:
 - support Renesas R-Car V4H DSC
 - dsi: Support larger transfers with AXI memory
 - Support RZ/G3L SoC
 
 repaper:
 - replace simple-display pipeline with regular atomic helpers
 
 rockchip:
 - dsi: improve PHY timings
 
 ssd130x:
 - support Solomon SSD1351 OLED plus DT bindings
 - ssd133x: upgrade color format to RGB565
 - ssd132x: Set correct hardware window when clearing screen
 
 tve200:
 - replace simple-display pipeline with regular atomic helpers
 
 xen:
 - replace simple-display pipeline with regular atomic helpers
 
 v3d:
 - improve job handling under perfmon
 
 vc4:
 - reliably reset V3D
 - drop brcm,vc4-v3d compatible
 
 virtio:
 - fix damage handling
 - Support ARGB8888 for virtio primary planes.
 
 host1x:
 - Support partitioning
 
 imx:
 - Replace simple-display with regular atomic helpers
 
 mxsfb:
 - Support bus formats plus DT bindings
 
 tegra:
 - improve syncobj handling on submit
 
 panfrost:
 - add Mali-G68 support
 - improve GPU reset handling
 
 rockchip:
 - add HDMI 2.0 support to dw-hdmi-qp
 - improve HPD handling
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrYXp8ACgkQDHTzWXnE
 hr4FZQ//TTxnbkFAcyHBhLHLfGrUk2tyDdBR3RL+89PVR+K/XB4thjxQnS0IuF9I
 NM9KB+Fa1PYOlnvKOAbKBqB8m4E+ATBmkzZ1nbY4DDvIPPZMTIF27yD5OJI/GoP7
 zvDTgGLK3oeXCydjUM7R3jXD7gjJ4KOe82Um1TWxCmpwMU4P8/5u3/lzfz8Lxael
 XLwnp1t/tjCWtxlrok1t3XjNkUv0PiGuA9YQvbXEV2wArguhNUcMtwFfBcuOCCf/
 eo9k29l0/lJgg8oFAOiLXxQbjcDqbF2NzHZbrBAWaZ50Wkzx2xv/WRLog6NT/ziN
 ScrdzVVgiAvhERaSmFT3eZxqy7g1pvHpej9KGsbqVqpxWdZeGMO9zSa52SqN62P6
 YeqDr5IGyi6HAstcSSwtE/UByEftTGJfUDytASugzOZOFFvj4M0ITBT9ElYtdL2c
 aSn/M30JFmV4i1C+jKFxteBJOqurF+p/CqdqxmHSz6sLcsgzHThMknGMoZYlIvUR
 0xewU7BFjUz4dT1r2UI+5GGV8Yibt4keyi00CitL+KWhTGcsGz8eLYXwtzbAU3Lb
 DlbV/gU77dHAI7yKz00BNLoVnRBRpzZRoPQmS0kRWpxHDu3WMksCLYNMQ1VL/DiC
 PyYIFK77SC8k+CnzKYLwP27zzEIS4pNrncBlp41g/Fj4tyzf4gc=
 =PWSa
 -----END PGP SIGNATURE-----

Merge tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel

Pull drm updates from Dave Airlie:
 "Highlights:

   - core: a lot of atomic refactoring in progress, panic got split into
     a core/helpers model

   - amdgpu: enables HDMI 2.1 FRL and other good things finally, UAlink
     over Ethernet support

   - xe: has a bunch of CRI support, ras error for bad vram, memory
     offlining support.

   - msm: enables a bunch more GPUs.

  Otherwise it's a the usual mountain of stuff all over the place.
  Details:

  rust:
   - I/O tree shared with driver-core
   - DMA tree shared with driver-core
   - allow aux registration data closures to return covariant sub-fields
   - Implement Send and Sync for MapleTree
   - add pci resource flags and IORESOURCE_MEM_64

  drm/rust:
   - add dma_fence abstraction
   - init DRM registrations and their data in place
   - drop unused flags argument to registration

  vgaarb:
   - rework API to pass a private ptr instead of pci device

  sound:
   - adapt to omapdrm changes

  gem:
   - add callback for handle count going to 0

  gpusvm:
   - share one HMM fault and keep single mappings inline

  pagemap:
   - Prevent CPU stalls during unbounded pagemap teardown

  dma-fence:
   - fix docs

  vga_switcheroo:
   - disconnect from fbcon
   - update fbcon from within fbdev emulation

  atomic:
   - move DRM from state reset callbacks to atomic_create_state
   - remove drm_simple_encoder_init

  panic:
   - split into core and helpers

  buddy:
   - improve dirty tracking

  clients:
   - improve vmap handling
   - fbdev: Move helpers from drm_kms_helper.ko to drm_client_lib.ko

  display:
   - export HDMI SCDC status data via debugfs
   - rework SCDC for better HDMI 2.0 support
   - dp/mst: improve DPCD compliance

  edid:
   - parse AMD VSDB
   - parse ALLM/VRR capabilities
   - support detecting panel size

  log:
   - add drm_warn_ratelimited

  sched:
   - cleanup interface
   - add missing locking
   - fix run-queue cleanup
   - fix locking

  sysfb:
   - remove obsolete quirk for Lenovo D330
   - fix panel orientation for non-native display modes
   - drop drm_class_device_register

  colorop:
   - provide DRM_COLOR_OP_FIXED_MATRIX

  bridge:
   - analogix: Support eDP lane mapping
   - ti-sn65dsi83: Support LVDS Channel B on SN65DSI84
   - Select DRM_PANEL_BRIDGE for various drivers that require it
   - add chrontel ch7218a support

  panel:
   - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
   - samsung-s6d16d0: Use mipi_dsi_*_multi() functions
   - support Ilitek ILI7836A OLED plus DT bindings
   - support Novatek NT36532 plus DT bindings
   - convert several drivers to managed cleanup
   - fix Kconfig selections
   - edp:
      - Add support for BOE NV140FHM-T0A
      - Support CSOT MNE007QB1-1
      - NV140WU2-M70
   - ebbg-ft8719: Fix MODULE_LICENSE() string; Improve initialization
   - samsung: Share test-key helpers
   - ilitek-ili9882t: Support Ilitek IL79600A plus DT bindings
   - simple: Support Truly TFT320240-229-E plus DT bindings; Support BOE
     DV215FHM-R01 plus DT bindings
   - Refactor struct drm_panel to contain struct drm_bridge plus fallout
     in various panel drivers
   - Add support for BOE Novatek NT51021, Retroid Pocket 6, Raydium
     RM69220 DDIC panels, Sharp LQ138P1JX61 eDP, BOE NV140FHD-N43, AUO
     B140HAN04.0, AUO 0x0db3, panels.

  amdgpu:
   - use AMD VSDB for freesync
   - implement YUV-to-RGB with fixed-matrix colorop
   - enable FRL for HDMI
   - HDMI 2.1 freesync support
   - HDMI 2.1 ALLM support
   - HDMI 2.1 VRR support
   - UALoE (UALink over Ethernet) support
   - add syncobj_points to userq signal ioctl
   - drop unused kunit tests
   - NBIO/GC/MMHUB/SMU updates/fixes
   - GPU spatial partitioning updates
   - display kunit fixes
   - userq fixes
   - RGB quantization fixes
   - DC RMCM refactor
   - DP MST fixes
   - USB4 fixes
   - add new trace events
   - Rework display instance handling
   - stack frame size fixes for various compilers/configs
   - VCN 4/5 reset fixes
   - freesync updates
   - cursor refactor
   - Fix direct scanout alpha on some DRM_FORMATs
   - Expand Mac reserved memory workaround
   - Make runtime pm more fine grained

  amdkfd:
   - updates and fixes
   - GC 10 CU occupancy support

  radeon:
   - eDP fix for DCE3.2 iMacs

  xe:
   - add drm_ras netlink error event support
   - add memory page offlining support
   - introduce error threshold to drm_ras
   - fix stale GTT mappings on unmap
   - reject page faults for non-page fault mode scratch VM
   - enable CRI package and VRAM temperatures
   - introduce cold reset recovery
   - handle CRI+ power interval encoding
   - VF migration for multi-queue
   - handle exec queue teardown after hot unplug
   - alerts and controller enabling modifications
   - use IBCv3 on PTL
   - VRAM health check
   - report GT TDR and VM rebind faults using SIGID
   - add multi_queue_active_lrca debugfs
   - shrinker: Runtime PM reference for non-system memory
   - guc: Add simple KLV decoder helpers
   - debugfs: Expose per-engine idle status
   - Keep walking on SVM eviction failure
   - Nuke PTs only after unlinking contested VMAs
   - limit sg segment size to PAGE_SIZE on Xen PV
   - keep VF LMEM bar size low if no VFs
   - CPU binds and ULLS on migration queue
   - New PTL PCI ID
   - Enable PXP for NVL-S
   - Do not dma_fence_put zero fences in err_out path
   - Refresh TTM LRU on SVM prefetch
   - export device UID in sysfs

  i915:
   - rename GEN6_PCODE_DATA to match spec
   - fix incorrect RCU teardown order
   - fix potential UAF in command parsing
   - avoid WARN splat during RPS boosting race
   - use simpler min functions
   - Fixes to make i915 work well with PREEMPT_RT

  i915/display:
   - Enable CMRR (Content Match Refresh Rate) in fixed-RR VRR path
   - Switch DG2 MPLL to DPLL framework
   - DP-HDMI PCON DSC fixes
   - limit invalid joiner combinations
   - CDCLK related fixes and refactor around PCODE integration
   - Gate UHBR SST SDP splitting on sink caps
   - add HDMI TMDS audio bandwidth check
   - vswing/preemph override
   - enable AS SDP Skip frames
   - Handle negative configuration index on DP link caps for robustness
   - Preparation for enabling SDR plane color pipeline
   - An eDP quirk for HP Pavilion Plus
   - Introduce PME (Power Management Event) support on display hotplug
   - Handle VSC SDP revision 7 in unpack

  msm:
   - CI:
      - Dropped sc7180 trogdor lazor from the CI
   - Core:
      - Fixed msm_ioremap for resources without a name
      - Changed msm.separate_gpu_kms to default to auto selection
   - GPU:
      - Enable CLX (Current Limit eXtension) for gen8 to avoid exceeding
        limits on CX/GX rails
      - New GPUs: a830 (Pakala), a845 (Maili), a850 (Hawi), x2-85
        (Mahua)
      - Fix VBIF halt mask on a306, which was preventing runpm suspend
      - Enable THP support for GEM buffers
      - Add modparam to disable waiting on fences in shrinker
      - Drop use of drm_prime_sg_to_page_array()
      - a5xx: don't read the GPMU registers on GPUs without a GPMU
      - a2xx/a3xx/a5xx: hangcheck progress detection
      - a6xx: gmuwrapper runpm fix
      - Calculate reported GMEM size based on active slices
      - Split a6xx/a7xx/a8xx catalog
   - DP:
      - Picked up some preparation patches for the MST support
      - Fixed reported status of the link training
   - DPU:
      - Fixed CRTC bandwidth computation
      - Fixed DSC programming
      - Fixed encoder disablement path
   - DSI:
      - Fixed VM leak in error path
      - Indention fix
   - MDP5:
      - Added MSM8952 configuration
      - Dropped incorrect cursor pipe on MSM8976/56
   - HDMI:
      - Small fixes

  nouveau:
   - improve runtime PM on R570 GSP firmware
   - various fixes throughout the driver
   - dispnv50: support 2.147 GHz pixel clock in GB20x

  nova:
   - add initial uapi concept
   - add initial PRAMIN access support
   - add GpuMm centralized memory manager
   - add GPU VM and BAR1 support
   - add GPU interrupts and GSP events support
   - GSP messaging fixes

  tyr:
   - use bitfield!
   - zero unsupported and newly added GPU info fields
   - limit doorbell array to 17 entries

  exynos:
   - FIMD fixes
      - Fix clock leak on resume error path
      - Fix Sparse warnings by adding missing __iomem annotation
   - VIDI cleanup
      - Replace kmalloc() and copy_from_user() with memdup_user()

  amdxdna:
   - fix BO handling
   - Support AIE2 rev 9
   - Fix UAF access in scheduler fences
   - Update workqueue interface
   - expose busy time via fdinfo

  ast:
   - support 256-byte EDID

  hyperv_drm:
   - remove support for pre win10 hosts

  komeda:
   - fix GLB_CORE_ID usage

  omap:
   - report HDMI hotplug events to ASoC HDMI codec

  panthor:
   - provide gpu_cache_flush tracepoint
   - improve dma_fence signalling latency
   - improve locking
   - export scheduling information via debugfs
   - Validate user-space input against firmware limits

  qaic:
   - reject BOs that exceed maximum page count
   - add missing include statements

  verisilicon:
   - fix hardware cursor offsets

  vkms:
   - implement YUV-to-RGB with fixed-matrix colorop

  gma500:
   - avoid unsupported ARGB formats in primary plane

  hibmc:
   - handle vblank interrupts correctly

  ivpu:
   - add DRM_IVPU_CAP_CMDQ_SET_PRIORITY
   - support command-queue priority ioctl
   - Simplify NULL-pointer handling in cleanup code

  arcpgu:
   - replace simple-display pipeline with regular atomic helpers

  aspeed:
   - replace simple-display pipeline with regular atomic helpers

  gm12u320:
   - replace simple-display pipeline with regular atomic helpers

  imagination:
   - various improvement to firmware interaction
   - add job to pvr_job_submit_fw trace event

  mali-dp:
   - fix runtime PM leak

  mcde:
   - replace simple-display pipeline with regular atomic helpers

  p111:
   - replace simple-display pipeline with regular atomic helpers
   - drop unsupported alpha formats from primary plane

  rcar-du:
   - support Renesas R-Car V4H DSC
   - dsi: Support larger transfers with AXI memory
   - Support RZ/G3L SoC

  repaper:
   - replace simple-display pipeline with regular atomic helpers

  rockchip:
   - dsi: improve PHY timings

  ssd130x:
   - support Solomon SSD1351 OLED plus DT bindings
   - ssd133x: upgrade color format to RGB565
   - ssd132x: Set correct hardware window when clearing screen

  tve200:
   - replace simple-display pipeline with regular atomic helpers

  xen:
   - replace simple-display pipeline with regular atomic helpers

  v3d:
   - improve job handling under perfmon

  vc4:
   - reliably reset V3D
   - drop brcm,vc4-v3d compatible

  virtio:
   - fix damage handling
   - Support ARGB8888 for virtio primary planes.

  host1x:
   - Support partitioning

  imx:
   - Replace simple-display with regular atomic helpers

  mxsfb:
   - Support bus formats plus DT bindings

  tegra:
   - improve syncobj handling on submit

  panfrost:
   - add Mali-G68 support
   - improve GPU reset handling

  rockchip:
   - add HDMI 2.0 support to dw-hdmi-qp
   - improve HPD handling"

* tag 'drm-next-2026-10-21' of https://gitlab.freedesktop.org/drm/kernel: (2324 commits)
  drm/adp: Switch to drm_atomic_helper_connector_create_state
  drm/malidp: Convert to atomic_create_state
  drm/vc4: Switch to drm_atomic_helper_connector_create_state
  drm/sysfb: Switch to drm_atomic_helper_connector_create_state
  drm/solomon: ssd130x: Switch to drm_atomic_helper_connector_create_state
  drm/imx: ipuv3: Switch to drm_atomic_helper_connector_create_state
  drm/hyperv: Switch to drm_atomic_helper_connector_create_state
  drm/bridge: megachips: Switch to drm_atomic_helper_connector_create_state
  drm/bridge: lontium-lt8912b: Switch to drm_atomic_helper_connector_create_state
  drm/arm: komeda: Switch to drm_atomic_helper_connector_create_state
  drm/appletbdrm: Fix incorrect error message on encoder attach failure
  drm/sun4i: hdmi: Convert to drmm_connector_hdmi_init()
  drm/rockchip: rk3066_hdmi: Advertise HDMI 1.4 capabilities
  drm/bridge: lontium-lt9611: Advertise HDMI 1.4 capabilities
  drm/bridge: ite-it66121: Advertise HDMI 1.2 capabilities
  drm/bridge: ite-it6263: Advertise HDMI 1.3 capabilities
  drm/bridge: ite-it6263: Drop redundant .mode_valid hook
  drm/bridge: inno-hdmi: Advertise HDMI 1.2 capabilities
  drm/bridge: adv7511: Advertise HDMI 1.2 capabilities
  drm/sched: Document entity->stopped is protected by entity->lock
  ...
2026-10-23 18:29:02 -10:00
Pavel Begunkov
aeef964d73 dma-buf-io: document dma_buf_io_init_map
Add a kerneldoc for dma_buf_io_init_map().

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/a9fdfbe6e447ac583f4d3a3f981b203141a624c4.1792144609.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-10-16 08:22:28 -06:00
Pavel Begunkov
44e75dbecb dma-buf-io: fix typos in kernel docs
Fix some typos and inconsistencies in dma-buf-io kernel docs.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/f328e279c3995cd36458ba2684c91d1bf24f057d.1792144609.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-10-16 08:22:28 -06:00
Pavel Begunkov
0d3120db2c dma-buf: introduce initial file I/O infrastructure
The goal is to be able to natively use dma-buf in the read-write / IO
path. This patch adds basic building blocks serving as a glue and API
between drivers and upper layer subsystems providing the uAPI. Later
patches implement it for NVMe raw block devices and expose it to the
user space via io_uring.

There are two main objects. struct dma_buf_io_ctx and struct
dma_buf_io_map. The ctx is used during initial registration and serves
as an interface between the upper layer user like io_uring and to the
importer subsystem / driver. The map represents the actual dma map
established for the target device[s] with dma_buf_map_attachment() and
stored in a device specific format. The context is created via a new
file operation ->init_dma_buf_io_ctx.

The ctx-map separation exists to facilitate map invalidation (see
dma_buf_io_invalidate_mappings()). A ctx can create
multiple maps during its lifetime, but there can only be no more than
one (active) map attached to it. Invalidation drops the active map
if present, and any new I/O request will try to create a new one.

The primary task of dma_buf_io_map is to count requests using it
and wait for their completion when we want to destroy the DMA map.

[un]mapping and any work with dma addresses is delegated to the
importer driver via an ops table stored in the ctx, see struct
dma_buf_io_ops. Only the target driver / subsystem knows about devices
it wants to use the dma-buf with, especially in case of multi-device
filesystems or stacking in the future.

Acked-by: Matthew Brost <matthew.brost@intel.com>
Tested-by: Matthew Brost <matthew.brost@intel.com>
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/49e24334953262e85d5616c9afde88c680e4f3a3.1791975048.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-10-14 07:36:02 -06:00
Baineng Shou
91f52e9982 dma-buf/test: add KUnit case for dma_fence_dedup_array() empty input
Add a KUnit case verifying that dma_fence_dedup_array() returns 0,
not 1, when called with num_fences == 0. This locks down the
contract documented in the kernel-doc and prevents a regression
of commit 77a9298741 ("dma-fence: Make dma_fence_dedup_array()
robust against 0-count input").

Suggested-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Baineng Shou <shoubaineng@gmail.com>
Link: https://lore.kernel.org/r/20261014024909.1769215-1-shoubaineng@gmail.com
Signed-off-by: Christian König <christian.koenig@amd.com>
2026-10-14 14:35:48 +02:00
Jianfeng Liu
5e0ed11085 Revert "dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels"
This reverts commit 143755bdab.

That commit fixed a dangling reference in the DMABUF_DEBUG default
and thereby enabled the option - and with it the page-stripping
sg_table wrapper that dma_buf_map_attachment() hands to importers -
on every kernel with DEBUG_KERNEL=y, i.e. virtually every distro
kernel.

drm/msm is broken by the wrapper.  Both of msm's map paths consume
sg->length and sg_phys() of the attachment sg_table:
msm_iommu_pagetable_map() for the per-process GPU pagetables, and
iommu_map_sg() (via iommu_map_sgtable()) for scanout.  The wrapper
zeroes sg->length and strips the page pointers, so mappings of
imported dma-bufs silently map nothing, and userspace observes
arm-smmu translation faults from UCHE, e.g. during hardware video
decode (clapper, chromium) on Adreno systems:

  gpu fault: ttbr0=000000088a889000 iova=000000010741c000 dir=READ
  type=TRANSLATION source=UCHE

Bisected on a Snapdragon X1E78100 laptop as v7.3-rc3 good,
v7.3-rc4 bad, culprit 143755bdab.

Switching msm to sg_dma_address()/sg_dma_len() is not a trivial fix
either: those fields are only valid for sg_tables that msm has
dma-mapped itself, which native non-MSM_BO_WC objects' sg_tables
are not, so the conversion needs more work.  The msm maintainer has
therefore requested restoring the previous default for v7.3, to be
revisited once msm no longer consumes struct page and sg->length of
imported sg_tables.

Link: https://lore.kernel.org/linux-arm-msm/20260923074256.9357-1-liujianfeng1994@gmail.com/
Suggested-by: Rob Clark <robin.clark@oss.qualcomm.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Karl Mehltretter <kmehltretter@gmail.com>

Signed-off-by: Jianfeng Liu <liujianfeng1994@gmail.com>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
 [sumits: as discussed on
  https://lore.kernel.org/all/CAO_48GEh1p52pA_-NE=rN=_NQ=oAXpeHgHGVZCH6uPnFq7G1gQ@mail.gmail.com/
  applying this revert for 7.3 unblock]
Link: https://patch.msgid.link/20260926022026.10539-1-liujianfeng1994@gmail.com
2026-10-13 19:26:28 +05:30
Dave Airlie
b0a3a81163 Linux 7.3-rc4
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmqwRo8eHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGEmgIAKHd1iqRMsE9n2Uu
 BQmoNeApUDcG8TMlcm99Ke1IAgOV5nF6pqW+Pl9UMmo6RttB03LdDhVEcS8kVR19
 16+VQEzmCRxK2XctWC8OXjmxQ1hde7K7xhjCf+igs8hPMK5r3Z8fn9yCD3DYyDsA
 VwIp6whpYFElWDeCXv6u9FYcSwB25ARetVZmNoPF4or2QwPMz8SE0jVp9wtb5u5d
 QV3+IWFTvHLCemVy1cpbJAofKV7RAawwcvoPx5k/Z1OV5l22oXf5yhgPdDtlt0ud
 x0tsM0EHcHCx1wHn/m1ItAL8L0u+GHpacjKUktufh1N1xwlKhzlor/HBkHpcxd8V
 8AZdRZ4=
 =KuKg
 -----END PGP SIGNATURE-----

Backmerge tag 'v7.3-rc4' into drm-next

Linux 7.3-rc4

Requested by Philipp Stanner for
2ab510e631 would be needed as a groundlayer
for further patches that extend the locking in drm_sched

Signed-off-by: Dave Airlie <airlied@redhat.com>
2026-09-22 18:35:06 +10:00
Christian König
3ed11c671f dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3
The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference"
changed the check to test for the ops pointer instead of the signaled
bit to avoid a potential NULL dereference when the ops pointer has been
cleared.

The problem is now that the ops pointer is cleared only when neither the
release nor the wait callback is implemented and this isn't true for a lot
of dma_fence implementations yet. So those implementations lost the RCU
protection after signaling of the returned string resulting in potential
use after free.

Add the signaling check additional to the ops pointer check so that we
have both the protection against NULL dereference as well as the RCU
protection after signaling for the returned string.

v2: improve comments to note RCU protection and explain why we check
    both signaling state and ops pointer
v3: some comment improvements suggested by Philip

Signed-off-by: Christian König <christian.koenig@amd.com>
Fixes: 035219a760 ("dma-buf: dma-fence: Fix potential NULL pointer dereference")
CC: stable@vger.kernel.org # 7.2+
Reported-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
Tested-by: Jonghyuk Kim(MalHyuk) <malhyuk97@gmail.com>
Reviewed-by: Philipp Stanner <phasta@kernel.org>
Link: https://lore.kernel.org/r/20260914182740.1587-1-christian.koenig@amd.com
2026-09-15 10:02:53 +02:00
David Hu
06dd5e1ae8 dma-buf: Split sgl by largest page-aligned chunk
Currently, `fill_sg_entry()` splits the scatterlist using `UINT_MAX`.
This creates a non-page-aligned DMA length (`0xFFFFFFFF`) for the
first entry, resulting in non-page-aligned DMA addresses for all
subsequent entries.

While the underlying IOMMU mapping may be contiguous, hardware
DMA engines often require explicit address alignment (e.g., page,
cacheline, or storage sector boundaries). Passing unaligned
addresses and lengths can cause explicit failures in DMA descriptor
creation or silent data corruption if lower unaligned bits are
truncated.

In addition, a non-page-aligned sgl length will trigger an edge case
in `ib_umem_find_best_pgsz()`. In case of a discontinuity in later
buffers, we will have a `va` with lowest bit set to 1. That will lead
to `ib_umem_find_best_pgsz()` always return 0, and break the promise
to find best page size for the mapping on the NIC side.

Fix this by splitting the scatterlist by the largest possible page
aligned chunk within `UINT_MAX` (`ALIGN_DOWN(UINT_MAX, PAGE_SIZE)`).
This ensures all scatterlist DMA addresses and lengths remain page
aligned, while minimizing the total number of sgl entries.

Page-aligned entries allow the system to cleanly chunk payloads into
PCIe MaxPayloadSize (MPS) (e.g., 128 bytes, 256 bytes, 512 bytes).
As a result, this may help reduce TLP fragmentation in P2P transfers
and alleviate potential congestion within a logical PCIe switch
partition, especially when Relaxed Ordering is not possible due to
hardware constraints.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260609165431.778061F00893@smtp.kernel.org/
Fixes: 3aa31a8bb1 ("dma-buf: provide phys_vec to scatter-gather mapping routine")
Cc: stable@vger.kernel.org
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David Hu <xuehaohu@google.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20260901170849.4052816-3-dhu@x6u.co
2026-09-11 12:10:01 +02:00
David Hu
b344ca94e8 dma-buf: Fix silent overflow for phys vec to sgt
In case MMIO size is bigger than 4G and peer2peer DMA goes
through host bridge, we trigger a code path that assigns the
total linked IOVA (which is greater than 4G) to mapped_len.

Previously, `mapped_len` was declared as 32-bit `unsigned int`.
When accumulating `size_t` lengths, this leads to a silent wrap-around.
This truncation causes truncated lengths to be passed to functions
like `fill_sg_entry()`.

Fix this by changing `mapped_len` to `size_t` (64-bit). While
at it, fix similar potential overflow issues in `calc_sg_nents`
by using `check_add_overflow()` for `nents` and using
`unsigned int` for the loop iterator in `fill_sg_entry` to match.

Fixes: 3aa31a8bb1 ("dma-buf: provide phys_vec to scatter-gather mapping routine")
Cc: stable@vger.kernel.org
Cc: iommu@lists.linux.dev
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: David Hu <xuehaohu@google.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20260901170849.4052816-2-dhu@x6u.co
2026-09-11 12:09:31 +02:00
Karl Mehltretter
143755bdab dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels
Commit 646013f513 ("dma-buf: enable DMABUF_DEBUG by default on DEBUG
kernels") changed the default of DMABUF_DEBUG to "y if DEBUG", but no
Kconfig symbol DEBUG exists, so the option has had no default since.

Use DEBUG_KERNEL, the Kconfig symbol for a debug kernel.

Fixes: 646013f513 ("dma-buf: enable DMABUF_DEBUG by default on DEBUG kernels")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20260907020015.24719-1-kmehltretter@gmail.com
2026-09-11 11:55:40 +02:00
Dave Airlie
483ece619b drm-misc-next for v7.4:
UAPI Changes:
 
 colorop:
 - provide DRM_COLOR_OP_FIXED_MATRIX
 
 Cross-subsystem Changes:
 
 cgroups:
 - fix typos
 
 dma-buf:
 - fix typos
 
 sound:
 - adapt to changes in omapdrm
 
 Core Changes:
 
 atomic:
 - convert most of DRM from state reset callbacks to atomic_create_state
 - remove drm_simple_encoder_init(); update drivers
 
 buddy:
 - improve dirty-page tracking
 
 clients:
 - log: Improve vmap handling
 
 display:
 - export HDMI SCDC status data via debugfs
 
 edid:
 - parse AMD VSDB entries
 - parse ALLM/VRR capabilities
 
 log:
 - add drm_warn_ratelimited()
 
 sched:
 - add missing locking
 
 Driver Changes:
 
 amd:
 - display: Use AMD VSDB for FreeSync
 - display: Implement YUV-to-RGB with fixed-matrix colorop
 
 amdxdma:
 - various fixes
 
 ast:
 - support 256-byte EDID data
 
 bridge:
 - clean up redundant error reporting
 - ti-sn65dsi83: Simplify error condition logic
 
 hyperv_drm:
 - remove support for pre-Win10 hosts
 
 komeda:
 - fix usage of GLB_CORE_ID
 
 nouveau:
 - improve runtime PM on R570 GSP firmware
 - various fixes throughout the driver
 - dispnv50: Support 2.147 GHz pixel clock in GB20x
 
 omap:
 - report HDMI hotplug events to ASoC HDMI codec
 
 panel:
 - panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
 - samsung-s6d16d0: Use mipi_dsi_*_multi() functions
 - support Ilitek ILI7836A OLED plus DT bindings
 - support Novatek NT36532 plus DT bindings
 - convert several drivers to managed cleanup
 - fix Kconfig selections
 
 panthor:
 - provide gpu_cache_flush tracepoint
 - improve dma_fence signalling latency
 - improve locking
 
 qaic:
 - reject BOs that exceed maximum page count
 - add missing include statements
 
 verisilicon:
 - fix hardware cursor offsets
 
 vkms:
 - implement YUV-to-RGB with fixed-matrix colorop
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmqZbyAbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEGgNwR1TC3oj0KwIAKhga8cMi+oqZ+WIRq7i
 MsCI4Tdl3jukry9Yho8BIsaFpknVcYV+v3qNsR1Za0Hcu3Znd4nqL2TOv5piGESB
 ErUsMkn3OJoMZUuHsCxBUPtxYUhVgWYIFvFx5CXLdKhESeqLtmWsqEDu8QcikiNB
 Wn6eyYOyuCG5ZD9ZRrWXM7WTIVrsPVar62t8FHdtoVgms9bMxtQadSrFwpmWnESQ
 +a+O+K7mI6NC2oh/znvVFYmZa9INoKAJf16lPDfL7UC9GTHg52Gu+yZDj2rYkqQK
 p4k1zpZHU0WyyjKoQxIY9rBQ4BLuzy/JP8ZZQakLOA98mHMM9ZwvftvudH4I5PPK
 JMg=
 =4Nm4
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-next-2026-09-03' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

drm-misc-next for v7.4:

UAPI Changes:

colorop:
- provide DRM_COLOR_OP_FIXED_MATRIX

Cross-subsystem Changes:

cgroups:
- fix typos

dma-buf:
- fix typos

sound:
- adapt to changes in omapdrm

Core Changes:

atomic:
- convert most of DRM from state reset callbacks to atomic_create_state
- remove drm_simple_encoder_init(); update drivers

buddy:
- improve dirty-page tracking

clients:
- log: Improve vmap handling

display:
- export HDMI SCDC status data via debugfs

edid:
- parse AMD VSDB entries
- parse ALLM/VRR capabilities

log:
- add drm_warn_ratelimited()

sched:
- add missing locking

Driver Changes:

amd:
- display: Use AMD VSDB for FreeSync
- display: Implement YUV-to-RGB with fixed-matrix colorop

amdxdma:
- various fixes

ast:
- support 256-byte EDID data

bridge:
- clean up redundant error reporting
- ti-sn65dsi83: Simplify error condition logic

hyperv_drm:
- remove support for pre-Win10 hosts

komeda:
- fix usage of GLB_CORE_ID

nouveau:
- improve runtime PM on R570 GSP firmware
- various fixes throughout the driver
- dispnv50: Support 2.147 GHz pixel clock in GB20x

omap:
- report HDMI hotplug events to ASoC HDMI codec

panel:
- panel-edp: Support MNE007QS3-F, TM140VDXP15, and KD116N36-30NB-A001
- samsung-s6d16d0: Use mipi_dsi_*_multi() functions
- support Ilitek ILI7836A OLED plus DT bindings
- support Novatek NT36532 plus DT bindings
- convert several drivers to managed cleanup
- fix Kconfig selections

panthor:
- provide gpu_cache_flush tracepoint
- improve dma_fence signalling latency
- improve locking

qaic:
- reject BOs that exceed maximum page count
- add missing include statements

verisilicon:
- fix hardware cursor offsets

vkms:
- implement YUV-to-RGB with fixed-matrix colorop

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260903130548.GA91506@2a02-2455-9062-2500-3419-2212-e55c-8a45.dyn6.pyur.net
2026-09-08 21:05:35 +10:00
Linus Torvalds
1fc5a74b10 kmalloc_obj conversions for v7.3-rc2
- Run scripts/coccinelle/api/kmalloc_objs.cocci for v7.3
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCapuwVwAKCRA2KwveOeQk
 u5EeAP9TS7K4iVlw3KlZHuLIK2q+CQfALPepcu+ME2lO5dta4gEAxCTi0ZXmU7OT
 XbmWUd+DTkKNYCBW8E6Lvn72Er13uQs=
 =ZtN4
 -----END PGP SIGNATURE-----

Merge tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull kmalloc_obj conversions from Kees Cook:
 "Another run of the Coccinelle script for converting kmalloc()
  family of allocations to kmalloc_obj() via the existing rules
  in scripts/coccinelle/api/kmalloc_objs.cocci"

* tag 'kmalloc_obj-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  treewide: refresh kmalloc_obj() conversions
  drm/amd/display: Fix harmless type mismatch in allocation
2026-09-05 20:45:18 -07:00
Kees Cook
3a2c4d55e3 treewide: refresh kmalloc_obj() conversions
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
2026-09-04 21:37:00 -07:00
Haojie Li
eb10ac2104 dma-buf: fix comment in dma_buf_llseek to match implementation
The comment in dma_buf_llseek() referenced a "SEEK_END(0), SEEK_CUR(0)
pattern", but the implementation does not support SEEK_CUR - it only
handles SEEK_END and SEEK_SET, returning -EINVAL for anything else.

Replace SEEK_CUR with SEEK_SET in the comment so that it accurately
describes the supported idiomatic pattern.

Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
Link: https://lore.kernel.org/r/20260825064041.328640-1-lihaojie@kylinos.cn
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
2026-09-02 10:04:55 +02:00
Maxime Ripard
67f8bc848e
Merge drm/drm-fixes into drm-misc-fixes
Let's start the 7.3 drm-misc-fixes cycle.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
2026-09-01 09:38:51 +02:00
Thomas Zimmermann
1ae7fe832c Merge drm/drm-next into drm-misc-next
Getting drm-misc-next up to v7.3-rc1.

In exynos, there was a conflict in exynos_dbi_bind(). The merge resolves
it to the state of commit 3cc8eee9f3 ("drm/exynos: remove dependency
on DRM simple helpers").

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2026-08-31 09:01:06 +02:00
Haojie Li
fe2aecf33a dma-buf: fix coding style in dma_resv_get_singleton
The conditional "if (r)" following the dma_resv_get_fences() call was
indented with spaces instead of a tab, violating the kernel coding
style. Fix it to use a single tab for consistency with the rest of
the function.

Signed-off-by: Haojie Li <lihaojie@kylinos.cn>
Link: https://lore.kernel.org/r/20260825064815.331653-1-lihaojie@kylinos.cn
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
2026-08-25 09:18:31 +02:00
Baineng Shou
30d0aff2c6 dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
DMA_HEAP_IOCTL_ALLOC allocates a dma-buf and installs an fd into the
caller's fd table via dma_buf_fd() -> fd_install() before
dma_heap_ioctl() copies the result back to userspace.  If the trailing
copy_to_user() fails, userspace never learns the fd number, but the
fd (and the underlying dma-buf reference) are already visible to
other threads in the same process and are leaked for the lifetime of
the process.

The obvious "close it on the failure path" fix is unsafe: once
fd_install() has run, another thread can already dup() the fd, send
it via SCM_RIGHTS, or close() it and let its number be reused, so a
subsequent close_fd() from the ioctl path can operate on an unrelated
file.  This was pointed out by Christian König on v1 [1].

Restructure the allocation path so that fd_install() is the last,
unfailable step of a successful ioctl:

  1. heap->ops->allocate()      creates the dma_buf.
  2. get_unused_fd_flags()      reserves an fd number in the caller's
                                fd table without publishing it, so
                                no other thread can observe it.
  3. copy_to_user()             delivers the fd number to userspace;
                                on failure the fd is returned with
                                put_unused_fd() and the dma_buf
                                reference is dropped with
                                dma_buf_put(), leaving no user-
                                visible state behind.
  4. dma_buf_fd_install()       publishes the fd and emits the
                                trace_dma_buf_fd tracepoint -- from
                                here on the ioctl cannot fail.

A new dma_buf_fd_install() helper is introduced in dma-buf.c to wrap
fd_install() together with the DMA_BUF_TRACE() call, preserving the
export tracing that dma_buf_fd() provides.  dma_heap_ioctl_allocate()
is refactored to return the struct dma_buf * directly (returning
ERR_PTR on failure) so the caller holds the dmabuf reference across
steps 3 and 4.

The failure at step 3 is easily reachable from userspace: pass a
struct dma_heap_allocation_data that lives in a page whose protection
is flipped to PROT_READ between copy_from_user() and copy_to_user()
(e.g. via mprotect()).  Before this change each such ioctl leaks one
dmabuf fd; after it, the fd table is unchanged on failure and only
/dev/dma_heap/<name> remains open.

No UAPI or heap-driver interface change.

[1] https://lore.kernel.org/dri-devel/175e98de-f414-47d7-81c1-c0fe0a8f7f62@amd.com/

Fixes: c02a81fba7 ("dma-buf: Add dma-buf heaps framework")
Cc: stable@vger.kernel.org
Reviewed-by: T.J. Mercier <tjmercier@google.com>
Acked-by: Christian König <christian.koenig@amd.com>
Acked-by: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Baineng Shou <shoubaineng@gmail.com>
Link: https://lore.kernel.org/r/20260817050457.1005285-2-shoubaineng@gmail.com
Signed-off-by: Christian König <christian.koenig@amd.com>
2026-08-24 13:57:59 +02:00
Dave Airlie
c44e278ce0 Linux 7.2
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmqCLGoeHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGJzYH/0SFjcgnk1Z3Km+3
 2kEeGAMETajW41W7+5QQkuHk83UXDxigDRoD857/d8utK90GrZAoTMS9/6zF3tra
 ht4G1yc2x7/xgVLkWii54d/sp1LEWTRDntN95fzYZwbeAXwd0AcYBlKXZYHKl4t/
 4yZCgYPmYTkewaYdbyWNPiZvCwhBUl5k1E9i/drh5IJXdgXRcqoO86FY9JX+Ks9x
 r0g+d6RIiSbDfwzgRpkBn0TRnqzh2OeBfgyrsgGZO2axwlKcA7SP0vwwT6c6nOUI
 s8F2xXrqrUI75JbSI4YbdwOSvktwbtkz83idlRAYBOdxof3LJ6i2YaxrT8iG+KUH
 l7+e18M=
 =eQMh
 -----END PGP SIGNATURE-----

BackMerge tag 'v7.2' into drm-next

Linux 7.2

There was a lot of conflicts this round between fixes and next,
and I'd like to get the merge resolutions that we have in drm-tip.

Signed-off-by: Dave Airlie <airlied@redhat.com>
2026-08-20 10:58:44 +10:00
Robert Mader
44e9eb5a76 dma-buf/udmabuf: Disable the size limit by default
As udmabuf increasingly enjoys popularity - being used in projects like
libcamera, Gstreamer, Mesa, KWin and Weston - users more frequently
encounter cases where the current default size limit of 64MB is too low.
Examples include allocating video buffers at a 8K resolution - and even 4K
is affected when using non-subsampled video formats and high bit depths.

In its current form the size limit for individual buffers does not seem to
provide any additional level of protection - such as limiting the amount of
memory a process can pin - as the later can just allocate multiple buffers.
If additional guardrails are desired, they would likely require some kind
accounting not limited to individual buffers.

Therefor let's disable the size limit by default by setting it to the
maximal possible value, INT_MAX.

Signed-off-by: Robert Mader <robert.mader@collabora.com>
Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Link: https://lore.kernel.org/dri-devel/20260711144814.8205-1-robert.mader@collabora.com/
Link: https://lore.kernel.org/dri-devel/6764ca6f-b4d8-4baa-9d27-2ca867ac2d41@amd.com/
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Link: https://patch.msgid.link/20260722110145.36641-1-robert.mader@collabora.com
2026-08-03 22:48:11 -07:00
Robert Mader
1d0e25c1dd udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()
The message of commit 504e2b4ab9 ("dma-buf/udmabuf: skip redundant cpu sync to
fix cacheline EEXIST warning") says:

> The CPU sync at map/unmap time is also redundant for udmabuf:
> begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit
> cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU
> access is requested through the dma-buf interface.

This, however, does not apply to the first time begin_cpu_udmabuf() is
called on an udmabuf, in which case the implementation previously relied on
get_sg_table() to perform the cache synchronisation.

Ensure to call dma_sync_sgtable_for_cpu() in that case as well.

Fixes: 504e2b4ab9 ("dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning")
Signed-off-by: Robert Mader <robert.mader@collabora.com>
Reviewed-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Link: https://patch.msgid.link/20260627105725.9083-1-robert.mader@collabora.com
2026-07-10 16:26:39 -07:00
Thomas Zimmermann
e7743a6b03 Merge drm/drm-next into drm-misc-next
Backmerging to get updates from v7.2-rc2 into drm-misc-next.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2026-07-08 13:00:55 +02:00
Dave Airlie
26934ed848 drm-misc-next for 7.3:
UAPI Changes:
 
 Cross-subsystem Changes:
 
 Core Changes:
 - bridge: Add atomic_create_state callback and helpers, drop atomic_reset
 - dp: Add support for DSC max delta BPP
 - edid: Parse panel type from DisplayID 2.x Display Parameters
 - sysfb: Improve panel, stride and framebuffer size validation
 
 Driver Changes:
 - hibmc: Improvements to the plane formats handling, switch to gem-shmem
 - nouveau: race fixes, misc improvements
 
 - bridges:
   - Convert all bridges to atomic_create_state
 
 - panels:
   - panel-edp: New quirks for BOE NE160QDM-NY1, MB116AS01
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCakYLBQAKCRAnX84Zoj2+
 du3xAYDaeJMk4mW1YryP7WUwoPMao4qRl+wXD8hrxPD0OTzlznJ2DhEZ5URaSMDN
 SmejA20Bf3z5wWMnkuKo/44rdYmcvytBBa9lwkgdiUkSk7t9lmrKr1Vz7V3xyWFE
 Vw0FTDSyxw==
 =7zUE
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-next-2026-07-02' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

drm-misc-next for 7.3:

UAPI Changes:

Cross-subsystem Changes:

Core Changes:
- bridge: Add atomic_create_state callback and helpers, drop atomic_reset
- dp: Add support for DSC max delta BPP
- edid: Parse panel type from DisplayID 2.x Display Parameters
- sysfb: Improve panel, stride and framebuffer size validation

Driver Changes:
- hibmc: Improvements to the plane formats handling, switch to gem-shmem
- nouveau: race fixes, misc improvements

- bridges:
  - Convert all bridges to atomic_create_state

- panels:
  - panel-edp: New quirks for BOE NE160QDM-NY1, MB116AS01

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <mripard@redhat.com>
Link: https://patch.msgid.link/20260702-powerful-successful-raptor-eded34@houat
2026-07-07 09:34:04 +10:00
Dave Airlie
00422c79d0 drm-misc-next for 7.3:
UAPI Changes:
  - connector: Add color format property
 
 Cross-subsystem Changes:
 
  - dmem: introduce a peak file
 
 Core Changes:
  - atomic: Add create_state callback and helpers to all objects, add
    documentation on atomic commit lifetime
  - buddy: Fix use-after-free, add per-order free and used block
    scoreboards
  - gem: Remove DRIVER_GEM_GPUVA feature flag
  - hdmi: Hook the color format property in the helpers
  - mipi-dsi: Add MIPI_DSI_MODE_DSC_ALL_SLICES_IN_PKT flag
  - sched: Add test suite for concurrent job submissions
  - virtio: Add support for saving and restoring virtio_gpu_objects,
    abort virtqueue wait on device removal to avoid hung task
 
 Driver Changes:
  - amdgpu: Implement "color format" DRM property
  - amdxdna: Disable device buffer exporting
  - ethosu: Add performance counter support
  - msm: Support DSC configurations with slice_per_pkt > 1
  - mxsfb: Fix disable sequence
  - panthor: Support sparse mappings
  - rockchip: Support YUV background color, Fix layer config timeout, add
    edp support for rk3576, cleanups and formats improvements
  - solomon: Add a batch command submission function
  - tegra: Add DSI support for Tegra 20 and 30, fix dsi driver when the
    firmware hasn't enabled the controller,
  - v3d: Reduce PM runtime autosuspend delay, Scheduler and submission
    fixes and refactoring, Deprecate V3D 3.3 and 4.1 support
 
  - bridge:
    - display-connector: don't autoenable HPD IRQ, trigger initial HPD
      event for DP
    - dw-dp: Null pointer dereference and use-after-free fixes
    - ti-sn65dsi83: Remove NO_HFP and NO_HBP mode flags
  - panel:
    - himax-hx83121a: add backlight regulator support
    - novatek-nt36672a: Inline panel init sequences
    - panel-edp: Add quirks for AUO B116XAT04.3, CMN N116BCP-EA2, CSW
      MNB601LS1-8, BOE NV116WH2-M30, BOE NT116WHM-N21, BOE NV116FH1-M31,
      BOE NV116FH1-M30, NV140FHM-N5B, TM156VDXP25
    - New panels: Samsung ATNA40HQ08-0, Anbernic TD4310, Chipone
      ICNA35XX, Ilitek ILI9488
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCajUI3wAKCRAnX84Zoj2+
 dhr8AX4l5GUDLOz5mbUJ4r5T9EQZ0lppj0RJjASkKBsogCC8CjYTrWzRqEbidJXH
 DGQ01dkBgM0/uWhVv3AZeNxov7yvzWA3JylYqy5Eg/xxLGRDXVtYT1fy9QvMSP1f
 T64BIaKqkw==
 =Gg4b
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-next-2026-06-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

drm-misc-next for 7.3:

UAPI Changes:
 - connector: Add color format property

Cross-subsystem Changes:

 - dmem: introduce a peak file

Core Changes:
 - atomic: Add create_state callback and helpers to all objects, add
   documentation on atomic commit lifetime
 - buddy: Fix use-after-free, add per-order free and used block
   scoreboards
 - gem: Remove DRIVER_GEM_GPUVA feature flag
 - hdmi: Hook the color format property in the helpers
 - mipi-dsi: Add MIPI_DSI_MODE_DSC_ALL_SLICES_IN_PKT flag
 - sched: Add test suite for concurrent job submissions
 - virtio: Add support for saving and restoring virtio_gpu_objects,
   abort virtqueue wait on device removal to avoid hung task

Driver Changes:
 - amdgpu: Implement "color format" DRM property
 - amdxdna: Disable device buffer exporting
 - ethosu: Add performance counter support
 - msm: Support DSC configurations with slice_per_pkt > 1
 - mxsfb: Fix disable sequence
 - panthor: Support sparse mappings
 - rockchip: Support YUV background color, Fix layer config timeout, add
   edp support for rk3576, cleanups and formats improvements
 - solomon: Add a batch command submission function
 - tegra: Add DSI support for Tegra 20 and 30, fix dsi driver when the
   firmware hasn't enabled the controller,
 - v3d: Reduce PM runtime autosuspend delay, Scheduler and submission
   fixes and refactoring, Deprecate V3D 3.3 and 4.1 support

 - bridge:
   - display-connector: don't autoenable HPD IRQ, trigger initial HPD
     event for DP
   - dw-dp: Null pointer dereference and use-after-free fixes
   - ti-sn65dsi83: Remove NO_HFP and NO_HBP mode flags
 - panel:
   - himax-hx83121a: add backlight regulator support
   - novatek-nt36672a: Inline panel init sequences
   - panel-edp: Add quirks for AUO B116XAT04.3, CMN N116BCP-EA2, CSW
     MNB601LS1-8, BOE NV116WH2-M30, BOE NT116WHM-N21, BOE NV116FH1-M31,
     BOE NV116FH1-M30, NV140FHM-N5B, TM156VDXP25
   - New panels: Samsung ATNA40HQ08-0, Anbernic TD4310, Chipone
     ICNA35XX, Ilitek ILI9488

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <mripard@redhat.com>
Link: https://patch.msgid.link/20260619-burgundy-termite-of-whirlwind-f7a4dd@houat
2026-07-06 17:38:49 +10:00
Shahyan Soltani
44d19b8a75 dma_buf: change unsigned int and int types into size_t
The num_fences, count, i, and j variables in dma_fence_dedup_array() and
__dma_fence_unwrap_merge() have inconsistent integer types, mixing both
unsigned int and int.

Use type size_t consistently for these instead, and update the return
type of dma_fence_dedup_array() accordingly.

Signed-off-by: Shahyan Soltani <shahyan.soltani@amd.com>
Suggested-by: Philipp Stanner <phasta@mailbox.org>
Link: https://lore.kernel.org/r/20260630160401.67544-1-shahyan.soltani@amd.com
Reviewed-by: Philipp Stanner <phasta@kernel.org>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
2026-07-02 09:27:51 +02:00
Christian König
9370a5c664 dma-buf: rename dma_fence_enable_sw_signaling
Dropping the _sw_ part from the names was proposed multiple times now and
IIRC people generally agreed with the idea already.

The function requests a fence to signal and triggers some sort of HW
interaction on most backends.

So this is not really software related at all and the callback is already
just named enable_signaling as well.

Just streamline that and use a consistent name everywhere.

Assisted-by: Claude Sonet 4
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Link: https://lore.kernel.org/r/20260624122917.2483-2-christian.koenig@amd.com
2026-07-01 16:52:48 +02:00
Thomas Zimmermann
827b9aabd3 Merge drm/drm-next into drm-misc-next
Backmerging to get drm-misc-next to v7.2-rc1.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2026-06-30 10:16:00 +02:00
Maarten Lankhorst
00599d4841 Merge drm/drm-fixes into drm-misc-fixes
Pull in tag v7.2-rc1 so that drm-misc-fixes becomes useful again,
and drm-misc-next-fixes can be closed.

Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
2026-06-29 17:58:00 +02:00
Baineng Shou
77a9298741 dma-fence: Make dma_fence_dedup_array() robust against 0-count input
dma_fence_dedup_array() returns 1 when called with num_fences == 0:
the for-loop body never executes, j stays at 0, and the final
`return ++j` yields 1. This contradicts both the kernel-doc ("Return:
Number of unique fences remaining in the array") and the natural
expectation that 0 input gives 0 output.

The caller __dma_fence_unwrap_merge() bails out via the
`if (count == 0 || count == 1)` fast path and so is save.

But amdgpu_userq_wait_*() could reach the dedup call with a zero local
count and dereference an uninitialized fence slot in the array.

Make the contract match the documentation by returning 0 early. This
also skips an unnecessary sort() call on an empty array.

Cc: stable@vger.kernel.org
Signed-off-by: Baineng Shou <shoubaineng@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Fixes: 575ec9b0c2 ("dma-fence: Add helper to sort and deduplicate dma_fence arrays")
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20260629031346.3875683-1-shoubaineng@gmail.com
2026-06-29 13:35:46 +02:00
Philipp Stanner
035219a760 dma-buf: dma-fence: Fix potential NULL pointer dereference
The commit mentioned in the fixes tag below introduced a mechanism
through which fence producers can fully decouple from fence consumers.
This, desirable, mechanism is based on the fence's signaled-bit as the
"decoupling point".

A sophisticated interaction between RCU and atomic instructions attempts
to ensure that fence consumers can still interact with fence producers
through the dma_fence_ops (callback pointers into the producer).

This is the desired behavior: to check for decoupling, the signaled-bit
is first checked. If it's not yet signaled, RCU ensures that the ops
pointer cannot yet be NULL.

Hereby, dma_fence_signal_timestamp_locked() first sets the signaled-bit,
and then sets the ops pointer to NULL. Readers first load the ops
pointer, and then check through the signaled-bit whether the pointer can
legally be accessed.

These set and load operations could occur out of order on weakly ordered
platforms. This problem can be solved very elegantly by using the ops
pointer itself as the synchronization point. The pointer is either NULL,
or cannot become NULL while it is being used thanks to RCU.

Replace the signaled-bit check in dma_fence_timeline_name() and
dma_fence_driver_name().

Cc: stable@vger.kernel.org
Fixes: f4cc3ab824 ("dma-buf: protected fence ops by RCU v8")
Signed-off-by: Philipp Stanner <phasta@kernel.org>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20260629075636.2513214-2-phasta@kernel.org
Signed-off-by: Christian König <christian.koenig@amd.com>
2026-06-29 13:18:36 +02:00
André Draszik
032a6f6ce2 dma-fence: use correct callback in dma_fence_timeline_name()
dma_fence_timeline_name() is a wrapper around
dma_fence_ops::get_timeline_name(). Since the blamed commit below, it
calls an incorrect callback.

Update it to restore functionality by calling the intended callback.

Fixes: 62918542b7 ("dma-fence: Fix sparse warnings due __rcu annotations")
Cc: <stable@vger.kernel.org> # v7.1+
[tursulin: added cc stable]
Signed-off-by: André Draszik <andre.draszik@linaro.org>
Reviewed-by: Philipp Stanner <phasta@kernel.org>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260618-linux-drm_crtc_fix-v1-1-801f29c9853d@linaro.org
2026-06-29 09:10:02 +01:00
Linus Torvalds
4b99990cdf drm-next for 7.2-rc1
core:
 - add docbook for DRM_IOCTL_SYNCOBJ_EVENTFD
 - change signature of drm_connector_attach_hdr_output_metadata_property
 - dedup counter and timestamp retrieval in vblank code
 - parse AMD VSDB v3 in CTA extension blocks
 - add P230, Y7, XYYY2101010, T430, XVUY210101010 formats
 - don't call drop master on file close if not master
 - use drm_printf_indent in atomic / bridge
 - fix 32b format descriptions
 - docs: fix toctree
 - hdmi: add common TMDS character rates
 - fix drm_syncobj_find_fence leak
 
 rust:
 - introduce Higher-Ranked lifetime types
 - replace drvdata with scoped registration data
 - add GPUVM immediate mode abstraction for rust GPU drivers
 - introduce DeviceContext type state for drm::Device
 
 bridge:
 - clarify drm_bridge_get/put
 - create drm_get_bridge_by_endpoint and use it
 - analogix_dp: add panel probing
 - ite-it6211 - use drm audio hdmi helpers
 
 buddy:
 - add lockdep annotations
 
 dp:
 - add PR and VRR updates
 - mst: fix buffer overflows
 - add Adaptive Sync SDP decoding support
 - fix OOB reads in dp-mst
 
 ttm:
 - bump fpfn/lpfn to 64-bit
 
 scheduler:
 - change default to fair scheduler
 - map runqueue 1:1 with scheduler
 
 dma-buf:
 - port selftests to kunit
 - convert dma-buf system/heap allocators to module
 - add separate DMABUF_HEAPS_SYSTEM_CC_SHARED Kconfig
 
 udmabuf:
 - revert hugetlb support
 - fix error with CONFIG_DMA_API_DEBUG
 
 dma-fence:
 - fix tracepoints lifetime
 - remove unused signal on any support
 
 ras:
 - add clear error counter netlink command to drm ras
 
 gpusvm:
 - reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges
 - use IOVA allocations
 
 pagemap:
 - use IOVA allocations
 
 panels:
 - update to use ref counts
 - add support for CSW PNB601LS1-2, LGD LP116WHA-SPB1
 - add support for waveshare panels
 - CMN N116BCN-EA1, CMN N140HCA-EEK, IVO M140NWFQ R5,
 - IVO, R140NWFW R0, BOE NT140*, BOE NV133FHM-N4F,
 - AUO B140*, AUO B133HAN06.6 and AUO B116XTN02.3 eDP panels
 - Surface Pro 12 Panel
 
 xe:
 - add CRI PCI-IDs
 - debugfs add multi-lrc info
 - engine init cleanup
 - PF fair scheduling auto provisioning
 - system controller support for CRI/Xe3p
 - PXP state machine fixes
 - Reset/wedge/unload corner case fixes
 - Wedge path memory allocation fixes
 - PAT type cleanups
 - Reject unsafe PAT for CPU cached memory
 - OA improvements for CRI device memory
 - kernel doc syntax in xe headers
 - xe_drm.h documentation fixes
 - include guard cleanups
 - VF CCS memory pool
 - i915/xe step unification
 - Xe3p GT tuning fixes
 - forcewake cleanup in GT and GuC
 - admin-only PF mode
 - enable hwmon energy attributes for CRI
 - enable GT_MI_USER_INTERRUPT
 - refactor emit functions
 - oa workarounds
 - multi_queue: allow QUEUE_TIMESTAMP register
 - convert stolen memory to ttm range manager
 - use xe2 style blitter as a feature flag
 - make drm_driver const
 - add/use IRQ page to HW engine definition
 - fix oops when display disabled
 
 i915:
 - enable PIPEDMC_ERROR interrupt
 - more common display code refactoring
 - restructure DP/HDMI sink format handling
 - eliminate FB usage from lowlevel pinning code
 - panel replay bw optimization
 - integrate sharpness filter into the scaler
 - new fb_pin abstraction for xe/i915 fb transparent handling
 - skip inactive MST connectors on HDCP
 - start switching to display specific registers
 - use polling when irq unavailable
 - Adaptive-sync SDP prep
 
 amdgpu:
 - use drm_display_info for AMD VSDB data
 - Initial HDMI 2.1 FRL support
 - Initial DCN 4.2.1 support
 - GART fixes for non-4k pages
 - GC 11.5.6/SDMA 6.4.0/and other new IPs
 - GFX9/DCE6/Hawaii/SDMA4/GART/Userq fixes
 - Finish support for using multiple SDMA queues for TTM operations
 - SWSMU updates
 - GC 12.1 updates
 - SMU 15.0.8 updates
 - DCN 4.2 updates
 - DC type conversion fixes
 - Enable DC power module
 - Replay/PSR updates
 - SMU 13.x updates
 - Compute queue quantum MQD updates
 - ASPM fix
 - Align VKMS with common implementation
 - DC analog support fixes
 - UVD 3 fixes
 - TCC harvesting fixes for SI
 - GC 11 APU module reload fix
 - NBIO 6.3.2 support
 - IH 7.1 updates
 - DC cursor fixes
 - VCN/JPEG user fence fixes
 - DC support for connectors without DDC
 - Prefer ROM BAR for default VGA device
 - DC bandwidth fixes
 - Add PTL support for profiler
 - Introduce dc_plane_cm and migrate surface update color path
 - Add FRL registers for HDMI 2.1
 - Restructure VM state machine
 - Auxless ALPM support
 - GEM_OP locking/warning fixes
 - switch to system_dfl_wq
 
 amdkfd:
 - GPUVM TLB flush fix
 - Hotplug fix
 - Boundary check fixes
 - SVM fixes
 - CRIU fixes
 - add profiler API
 - MES 12.1 updates
 
 msm:
 - core:
   - fix shrinker documentation
   - IFPC enabled for gen8
   - PERFCNTR_CONFIG ioctl support
 - GPU:
   - reworked UBWC handling
   - a810 support
 - MDSS:
   - add support for Milos platform
   - reworked UBWC handling
 - DisplayPort:
   - reworked HPD handling as prep for MST
 - DPU:
   - Milos platform support
   - reworked UBWC handling
 - DSI:
   - Milos platform support
 
 nova:
 - Hopper/Blackwell enablement (GH100/GB100/GB202)
   - FSP support
   - 32-bit firmware support
   - HAL functions
 - refactor GSP boot/unload
 - GA100 support
 - VBIOS hardening/refactoring
 - Adopt higher order lifetime types
 
 tyr:
 - define register blocks
 - add shmem backed GEM objects
 - adopt higher order lifetime types
 - move clock cleanup into Drop
 
 radeon:
 - Hawaii SMU fixes
 - CS parser fix
 - use struct drm_edid instead of edid
 
 amdxdna:
 - export per-client BO memory via fdinfo
 - AIE4 device support
 - support medium/lower power modes
 - expandable device heap support
 - revert read-only user-pointer BO mappings
 
 ivpu:
 - support frequency limiting
 
 panthor:
 - enable GEM shrinker support
 - add eviction and reclaim info to fdinfo
 
 v3d:
 - enable runtime PM
 
 mgag200:
 - support XRGB1555 + C8
 
 ast:
 - support XRGB1555 + C8
 - use constants for lots of registers
 - fix register handling
 
 imagination:
 - fence handling refactoring
 
 nouveau:
 - fix sched double call
 - expose VBIOS on GSP-RM systems
 - add GA100 support
 
 virtio:
 - add VIRTIO_GPU_F_BLOB_ALIGNMENT flag
 - add deferred mapping support
 
 gud:
 - add RCade Display Adapter
 
 hibmc:
 - fix no connectors usage
 
 mediatek:
 - hdmi: convert error handling
 - simplify mtk_crtc allocation
 
 exynos:
 - move fbdev emulation to drm client buffers
 - use drm format helpers for geometry/size
 - adopt core DMA tracking
 - fix framebuffer offset handling
 
 renesas:
 - add RZ/T2H SOC support
 
 versilicon:
 - add cursor plane support
 
 tegra:
 - use drm client for framebuffer
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmoyOXkACgkQDHTzWXnE
 hr5Pxg//VwqDYgf8CwWtLwXqHYBhGDwj1PDA/zLoosm32fXABKhzPMA5XcaPHBKh
 Y7Wyo7988cxXFQ0BRltKP1S3d04ck5ZbBA/qpwwX9Pz0u8HhNMicwLd9ASlWqqkP
 ogFIj3J8PsjlTMVI2cnzQ7s0TMQoQorUaNl13vQnITDPSNncCAunrKixpzVagHeK
 /ARlIg4kqSbvlKAhkvps7FbJUG3l/g901HdAcspp0bn6d3+4zz8Yg+yg/b4Xngdh
 Sn6UGDxwrNeBSHP2Spj5/rGSOuo4L8Fr1rS0+KEwRnEqrg+qdq9mo9l0xQsJV9/e
 4ql6nssEMC/CIHwHomsgCdxdOsj2DiXLUucJKBwavHHSWNHFgdLhNSdaUcwrkui3
 sLmahOEXFwFIR3K1X++547Wux9DhAWDcvq/SnxzN0dQBpN0AmpE0/o/3Vb7Vw4dO
 /cfvI4Y1WGviJCs58p36tqYGx8dDPuMh9tiUtQvBXBkkS87MqBX8wM49qHSlzEOV
 EkQfGV1cLMBJpZZkMezrqCNyIS7ghzXJ+K/IruAPrgvN7/kCY7hRclUT+Z/1Mqvc
 mw3Japbcy7P+BMKnlNfCZsDXg04kYZC5MOaMeiJOLg6qfHBHITD8gP1zct+RikIS
 d+43kYwt43dPj53jUUXpREoAezSoF2ktncFChB2tdeaMlb6oJIM=
 =86oS
 -----END PGP SIGNATURE-----

Merge tag 'drm-next-2026-06-17' of https://gitlab.freedesktop.org/drm/kernel

Pull drm updates from Dave Airlie:
 "Highlights:
   - xe: add initial CRI platform support
   - amdgpu: initial HDMI 2.1 FRL support
   - rust: add some new type concepts for device lifetimes
   - scheduler: moves to a fair algorithm and lots of cleanups

  But it's mostly the usual mountain of changes across the board.

  core:
   - add docbook for DRM_IOCTL_SYNCOBJ_EVENTFD
   - change signature of drm_connector_attach_hdr_output_metadata_property
   - dedup counter and timestamp retrieval in vblank code
   - parse AMD VSDB v3 in CTA extension blocks
   - add P230, Y7, XYYY2101010, T430, XVUY210101010 formats
   - don't call drop master on file close if not master
   - use drm_printf_indent in atomic / bridge
   - fix 32b format descriptions
   - docs: fix toctree
   - hdmi: add common TMDS character rates
   - fix drm_syncobj_find_fence leak

  rust:
   - introduce Higher-Ranked lifetime types
   - replace drvdata with scoped registration data
   - add GPUVM immediate mode abstraction for rust GPU drivers
   - introduce DeviceContext type state for drm::Device

  bridge:
   - clarify drm_bridge_get/put
   - create drm_get_bridge_by_endpoint and use it
   - analogix_dp: add panel probing
   - ite-it6211 - use drm audio hdmi helpers

  buddy:
   - add lockdep annotations

  dp:
   - add PR and VRR updates
   - mst: fix buffer overflows
   - add Adaptive Sync SDP decoding support
   - fix OOB reads in dp-mst

  ttm:
   - bump fpfn/lpfn to 64-bit

  scheduler:
   - change default to fair scheduler
   - map runqueue 1:1 with scheduler

  dma-buf:
   - port selftests to kunit
   - convert dma-buf system/heap allocators to module
   - add separate DMABUF_HEAPS_SYSTEM_CC_SHARED Kconfig

  udmabuf:
   - revert hugetlb support
   - fix error with CONFIG_DMA_API_DEBUG

  dma-fence:
   - fix tracepoints lifetime
   - remove unused signal on any support

  ras:
   - add clear error counter netlink command to drm ras

  gpusvm:
   - reject VMAs with VM_IO or VM_PFNMAP when creating SVM ranges
   - use IOVA allocations

  pagemap:
   - use IOVA allocations

  panels:
   - update to use ref counts
   - add support for CSW PNB601LS1-2, LGD LP116WHA-SPB1
   - add support for waveshare panels
   - CMN N116BCN-EA1, CMN N140HCA-EEK, IVO M140NWFQ R5,
   - IVO, R140NWFW R0, BOE NT140*, BOE NV133FHM-N4F,
   - AUO B140*, AUO B133HAN06.6 and AUO B116XTN02.3 eDP panels
   - Surface Pro 12 Panel

  xe:
   - add CRI PCI-IDs
   - debugfs add multi-lrc info
   - engine init cleanup
   - PF fair scheduling auto provisioning
   - system controller support for CRI/Xe3p
   - PXP state machine fixes
   - Reset/wedge/unload corner case fixes
   - Wedge path memory allocation fixes
   - PAT type cleanups
   - Reject unsafe PAT for CPU cached memory
   - OA improvements for CRI device memory
   - kernel doc syntax in xe headers
   - xe_drm.h documentation fixes
   - include guard cleanups
   - VF CCS memory pool
   - i915/xe step unification
   - Xe3p GT tuning fixes
   - forcewake cleanup in GT and GuC
   - admin-only PF mode
   - enable hwmon energy attributes for CRI
   - enable GT_MI_USER_INTERRUPT
   - refactor emit functions
   - oa workarounds
   - multi_queue: allow QUEUE_TIMESTAMP register
   - convert stolen memory to ttm range manager
   - use xe2 style blitter as a feature flag
   - make drm_driver const
   - add/use IRQ page to HW engine definition
   - fix oops when display disabled

  i915:
   - enable PIPEDMC_ERROR interrupt
   - more common display code refactoring
   - restructure DP/HDMI sink format handling
   - eliminate FB usage from lowlevel pinning code
   - panel replay bw optimization
   - integrate sharpness filter into the scaler
   - new fb_pin abstraction for xe/i915 fb transparent handling
   - skip inactive MST connectors on HDCP
   - start switching to display specific registers
   - use polling when irq unavailable
   - Adaptive-sync SDP prep

  amdgpu:
   - use drm_display_info for AMD VSDB data
   - Initial HDMI 2.1 FRL support
   - Initial DCN 4.2.1 support
   - GART fixes for non-4k pages
   - GC 11.5.6/SDMA 6.4.0/and other new IPs
   - GFX9/DCE6/Hawaii/SDMA4/GART/Userq fixes
   - Finish support for using multiple SDMA queues for TTM operations
   - SWSMU updates
   - GC 12.1 updates
   - SMU 15.0.8 updates
   - DCN 4.2 updates
   - DC type conversion fixes
   - Enable DC power module
   - Replay/PSR updates
   - SMU 13.x updates
   - Compute queue quantum MQD updates
   - ASPM fix
   - Align VKMS with common implementation
   - DC analog support fixes
   - UVD 3 fixes
   - TCC harvesting fixes for SI
   - GC 11 APU module reload fix
   - NBIO 6.3.2 support
   - IH 7.1 updates
   - DC cursor fixes
   - VCN/JPEG user fence fixes
   - DC support for connectors without DDC
   - Prefer ROM BAR for default VGA device
   - DC bandwidth fixes
   - Add PTL support for profiler
   - Introduce dc_plane_cm and migrate surface update color path
   - Add FRL registers for HDMI 2.1
   - Restructure VM state machine
   - Auxless ALPM support
   - GEM_OP locking/warning fixes
   - switch to system_dfl_wq

  amdkfd:
   - GPUVM TLB flush fix
   - Hotplug fix
   - Boundary check fixes
   - SVM fixes
   - CRIU fixes
   - add profiler API
   - MES 12.1 updates

  msm:
   - core:
     - fix shrinker documentation
     - IFPC enabled for gen8
     - PERFCNTR_CONFIG ioctl support
   - GPU:
     - reworked UBWC handling
     - a810 support
   - MDSS:
     - add support for Milos platform
     - reworked UBWC handling
   - DisplayPort:
     - reworked HPD handling as prep for MST
   - DPU:
     - Milos platform support
     - reworked UBWC handling
   - DSI:
     - Milos platform support

  nova:
   - Hopper/Blackwell enablement (GH100/GB100/GB202)
     - FSP support
     - 32-bit firmware support
     - HAL functions
   - refactor GSP boot/unload
   - GA100 support
   - VBIOS hardening/refactoring
   - Adopt higher order lifetime types

  tyr:
   - define register blocks
   - add shmem backed GEM objects
   - adopt higher order lifetime types
   - move clock cleanup into Drop

  radeon:
   - Hawaii SMU fixes
   - CS parser fix
   - use struct drm_edid instead of edid

  amdxdna:
   - export per-client BO memory via fdinfo
   - AIE4 device support
   - support medium/lower power modes
   - expandable device heap support
   - revert read-only user-pointer BO mappings

  ivpu:
   - support frequency limiting

  panthor:
   - enable GEM shrinker support
   - add eviction and reclaim info to fdinfo

  v3d:
   - enable runtime PM

  mgag200:
   - support XRGB1555 + C8

  ast:
   - support XRGB1555 + C8
   - use constants for lots of registers
   - fix register handling

  imagination:
   - fence handling refactoring

  nouveau:
   - fix sched double call
   - expose VBIOS on GSP-RM systems
   - add GA100 support

  virtio:
   - add VIRTIO_GPU_F_BLOB_ALIGNMENT flag
   - add deferred mapping support

  gud:
   - add RCade Display Adapter

  hibmc:
   - fix no connectors usage

  mediatek:
   - hdmi: convert error handling
   - simplify mtk_crtc allocation

  exynos:
   - move fbdev emulation to drm client buffers
   - use drm format helpers for geometry/size
   - adopt core DMA tracking
   - fix framebuffer offset handling

  renesas:
   - add RZ/T2H SOC support

  versilicon:
   - add cursor plane support

  tegra:
   - use drm client for framebuffer"

* tag 'drm-next-2026-06-17' of https://gitlab.freedesktop.org/drm/kernel: (1731 commits)
  dma-buf: move system_cc_shared heap under separate Kconfig
  accel/amdxdna: Clear sva pointer after unbind
  agp/amd64: Fix broken error propagation in agp_amd64_probe()
  accel/amdxdna: Require carveout when PASID and force_iova are disabled
  drm/amdkfd: always resume_all after suspend_all
  drm/amdgpu/gfx: move fault and EOP IRQ get/put to hw_init/hw_fini
  drm/amd/display: Consult MCCS FreeSync cap only if requested & supported
  drm/amd/pm: Use strscpy in profile mode parsing
  drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length
  drm/amdkfd: fix sysfs topology prop length on buffer truncation
  drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages
  drm/amd/pm: bound OD parameter parsing to stack array size
  drm/amd/pm: Stop pp_od_clk_voltage emit at PAGE_SIZE
  drm/amdkfd: Unwind debug trap enable on copy_to_user failure
  drm/amdgpu: validate the mes firmware version for gfx12.1
  drm/amdgpu: validate the mes firmware version for gfx12
  drm/amdgpu: compare MES firmware version ucode for gfx11
  drm/amdkfd: Add bounds check for AMDKFD_IOC_WAIT_EVENTS
  drm/amdgpu: restart the CS if some parts of the VM are still invalidated
  drm/amd/display: use unsigned types for local pipe and REG_GET counters
  ...
2026-06-17 10:21:00 +01:00
Arnd Bergmann
f7606400f1 dma-buf: move system_cc_shared heap under separate Kconfig
While system heap and system_cc_shared heap share a lot of code
and hence the same source file, their users have different needs.

system heap users need it to be a loadable module, while
system_cc_shared heap users don't.

Building as a loadable module breaks system_cc_shared heap on
powerpc and s390 due to un-exported set_memory_encrypted /
set_memory_decrypted functions.

Fix these by reorganising code to put the system_cc_shared heap
under a new Kconfig symbol, which allows either building both
into the kernel, or leave encryption up to the consumers of the
system heap.

Fixes: fd55edff8a ("dma-buf: heaps: system: Turn the heap into a module")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
  [sumits: updated DMABUF_HEAPS_CC_SYSTEM to DMABUF_HEAPS_SYSTEM_CC_SHARED]
Reviewed-by: T.J. Mercier <tjmercier@google.com>
Acked-by: Maxime Ripard <mripard@kernel.org>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20260610142329.3836808-1-sumit.semwal@linaro.org
2026-06-11 20:21:44 +05:30
Thorsten Blum
d59676b3eb dma-buf: heaps: use max3 in dma_heap_ioctl
Replace two nested max() calls with a single max3() in dma_heap_ioctl().

Reviewed-by: T.J. Mercier <tjmercier@google.com>
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patch.msgid.link/20260517172352.3615-2-thorsten.blum@linux.dev
2026-06-03 14:22:49 +05:30
Maíra Canal
e84b07e0a3 dma-fence: Clarify external lock use case in dma_fence_init() docs
The kerneldoc comment on dma_fence_init() and dma_fence_init64() describe
the legacy reason to pass an external lock as a need to prevent multiple
fences "from signaling out of order". However, this wording is a bit
misleading: a shared spinlock does not (and cannot) prevent the signaler
from signaling out of order. Signaling order is the driver's responsibility
regardless of whether the lock is shared or per-fence.

Reword both comments to better describe the legacy use cases where a
shared lock was needed.

Signed-off-by: Maíra Canal <mcanal@igalia.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/20260531125115.1136036-1-mcanal@igalia.com
Signed-off-by: Christian König <christian.koenig@amd.com>
2026-06-01 10:27:22 +02:00
David Carlier
ead6680f35 dma-buf: fix UAF in dma_buf_fd() tracepoint
Once FD_ADD() returns, the fd is live in the file descriptor table
and a thread sharing that table can close() it before DMA_BUF_TRACE()
runs. The close drops the last reference, __fput() frees the dma_buf,
and the tracepoint then dereferences dmabuf to take dmabuf->name_lock
-- slab-use-after-free.

Split FD_ADD() back into get_unused_fd_flags() + fd_install() and
emit the tracepoint between them. While the fdtable slot is reserved
with a NULL file pointer, a racing close() returns -EBADF without
entering __fput(), so the dma_buf stays alive across the trace. Same
approach as commit 2d76319c4c ("dma-buf: fix UAF in dma_buf_put()
tracepoint").

This undoes the FD_ADD() conversion done in commit 34dfce523c
("dma: convert dma_buf_fd() to FD_ADD()"); FD_ADD() has no place to
hook the tracepoint safely.

Reported-by: syzbot+7f4987d0afb97dd090cb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7f4987d0afb97dd090cb
Fixes: 281a226314 ("dma-buf: add some tracepoints to debug.")
Cc: stable@vger.kernel.org # 7.0.x
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patch.msgid.link/20260523181446.69525-1-devnexen@gmail.com
2026-05-28 20:05:43 +05:30
Maxime Ripard
fd55edff8a dma-buf: heaps: system: Turn the heap into a module
The system heap can be easily turned into a module by adding the usual
MODULE_* macros, importing the proper namespaces and changing the
Kconfig symbol to a tristate.

This heap won't be able to unload though, since we're missing a lot of
infrastructure to make it safe.

Reviewed-by: T.J. Mercier <tjmercier@google.com>
Acked-by: Andrew Davis <afd@ti.com>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patch.msgid.link/20260427-dma-buf-heaps-as-modules-v5-3-b6f5678feefc@kernel.org
2026-05-21 20:57:16 +05:30
Maxime Ripard
10bb37fc62 dma-buf: heaps: cma: Turn the heap into a module
All the symbols used by the CMA heap are already exported, so turning it
into a module is straightforward. We only need to add the usual MODULE_*
macros, import the proper namespaces and change the Kconfig symbol to a
tristate.

This heap won't be able to unload though, since we're missing a lot of
infrastructure to make it safe.

Reviewed-by: T.J. Mercier <tjmercier@google.com>
Acked-by: Andrew Davis <afd@ti.com>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patch.msgid.link/20260427-dma-buf-heaps-as-modules-v5-2-b6f5678feefc@kernel.org
2026-05-21 20:57:15 +05:30
Maxime Ripard
f78a0607c8 dma-buf: heaps: Export mem_accounting parameter
The mem_accounting kernel parameter is used by heaps to know if they
should account allocations in their respective cgroup controllers.

Since we're going to allow heaps to compile as modules, we need to
export that variable.

Reviewed-by: T.J. Mercier <tjmercier@google.com>
Acked-by: Andrew Davis <afd@ti.com>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patch.msgid.link/20260427-dma-buf-heaps-as-modules-v5-1-b6f5678feefc@kernel.org
2026-05-21 20:57:15 +05:30
Christian König
d4c14903bf dma-buf/dma_fence_array: remove unused functionality v4
Amdgpu was the only user of the signal on any feature and we dropped
that use case recently, so we can remove that functionality.

v2: update num_pending only after the fence is signaled
v3: separate out simplifying dma_fence_array implementation
v4: fix XE patch split fallout

Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Link: https://lore.kernel.org/r/20260422103012.1647-1-christian.koenig@amd.com
2026-05-04 16:28:14 +02:00
Thomas Zimmermann
cafac16b62 Merge drm/drm-next into drm-misc-next
Getting fixes and updates from v7.1-rc1.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2026-04-27 10:49:13 +02:00
Linus Torvalds
cf950766e9 drm fixes for 7.1-rc1
atomic:
 - raise the vblank timeout to avoid it on virtual drivers
 - fix colorop duplication
 
 bridge:
 - stm_lvds: state check fix
 - dw-mipi-dsi: bridge reference leak fix
 
 panel:
 - visionx-rm69299: init fix
 
 dma-fence:
 - fix sparse warning
 
 dma-buf:
 - UAF fix
 
 panthor:
 - mapping fix
 
 arcgpu:
 - device_node reference leak fix
 
 nouveau:
 - memory leak in error path fix
 - overflow in reloc path for old hw fix
 
 hv:
 - Kconfig fix
 
 v3d:
 - infinite loop fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmnrCR4ACgkQDHTzWXnE
 hr7HEw/9EynaVUxBlI+B+kKakkvt1fpRfaSwaWyawcqaS1XpBjwuUR/aUS44fHzE
 Z1ru6DACZPwKqRTTLm1urE7qjb3T1HKDgSV9LbLJCe3MOZ1HMmyfitoRgWvP/nXU
 bpwT7K79g0g87HMwVzyS13jqSeXmAbuuqF8cgyUsYUU7Jvl3tEd9FfOhwo4BG/4j
 4EDlj9SDrd6/3SbnKzVfrt6xl/ikpNxoYJlMVW3NIDzfZ8aKGdf/jYgKb3ezluDB
 2UAiZdFRiCQd0DunQvCBwnY5/dpxXIajWtAW2f6FWEqIS5mtXkVG6PPzpLRNEmkp
 wetjtnisqwkwSxFxz0pgEII0PsKoxKrQPBXz7zXH6bK6e3i4LQ09mt1Ufc3w9am3
 f29IW2AWYZzB1tOOmMt34mvDm49xXWt/7Q6hHAorQ9ABtb6V3SzsDKfDElEF2ULF
 g1WMCN9uh5ErWkEc1rqIjQ3TPI9EISfUG+hvvr75PA59EHE7a4tQGf45DNWPeC8+
 rO5m8aDKgif7exkoiA8fc8zq4shiH7/tGbJsnZP1GTgyQTBtT4Aik/rVT0zifDpY
 yQ0gwybnd9I7lXMVlhFPaq83HMsr38e8HyViubNmzA8zbd58cPRqBygPqIW6trWr
 6/kzoNFhjgICJsOSi8KkQAtT1zRnakiR1I3GfVos+1DyhC9yPIo=
 =WXJa
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel

Pull more drm fixes from Dave Airlie:
 "These are the regular fixes that have built up over last couple of
  weeks, all pretty minor and spread all over.

  atomic:
   - raise the vblank timeout to avoid it on virtual drivers
   - fix colorop duplication

  bridge:
   - stm_lvds: state check fix
   - dw-mipi-dsi: bridge reference leak fix

  panel:
   - visionx-rm69299: init fix

  dma-fence:
   - fix sparse warning

  dma-buf:
   - UAF fix

  panthor:
   - mapping fix

  arcgpu:
   - device_node reference leak fix

  nouveau:
   - memory leak in error path fix
   - overflow in reloc path for old hw fix

  hv:
   - Kconfig fix

  v3d:
   - infinite loop fix"

* tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel:
  drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
  MAINTAINERS: split hisilicon maintenance and add Yongbang Shi for hibmc-drm matainers
  drm/v3d: Reject empty multisync extension to prevent infinite loop
  drm/panel: visionox-rm69299: Make use of prepare_prev_first
  drm/drm_atomic: duplicate colorop states if plane color pipeline in use
  drm/nouveau: fix nvkm_device leak on aperture removal failure
  hv: Select CONFIG_SYSFB only for CONFIG_HYPERV_VMBUS
  dma-fence: Silence sparse warning in dma_fence_describe
  drm/bridge: dw-mipi-dsi: Fix bridge leak when host attach fails
  drm/arcpgu: fix device node leak
  drm/panthor: Fix outdated function documentation
  drm/panthor: Extend VM locked region for remap case to be a superset
  dma-buf: fix UAF in dma_buf_put() tracepoint
  drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector
  drm/atomic: Increase timeout in drm_atomic_helper_wait_for_vblanks()
2026-04-24 11:44:52 -07:00
Linus Torvalds
6596a02b20 drm for 7.1-rc1 (part 2)
drm:
 - Add support for AMD VSDB parsing to drm_edid
 
 dma-buf:
 - fix documentation formatting
 
 i915:
 - add support for reordered pipes to support joined pipes better
 - Fix VESA backlight possible check condition
 - Verify the correct plane DDB entry
 
 amdgpu:
 - Audio regression fix
 - Use drm edid parser for AMD VSDB
 - Misc cleanups
 - VCE cs parse fixes
 - VCN cs parse fixes
 - RAS fixes
 - Clean up and unify vram reservation handling
 - GPU Partition updates
 - system_wq cleanups
 - Add CONFIG_GCOV_PROFILE_AMDGPU kconfig option
 - SMU vram copy updates
 - SMU 13/14/15 fixes
 - UserQ fixes
 - Replace pasid idr with an xarray
 - Dither handling fix
 - Enable amdgpu by default for CIK APUs
 - Add IBs to devcoredump
 
 amdkfd:
 - system_wq cleanups
 
 radeon:
 - system_wq cleanups
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmnn8KcACgkQDHTzWXnE
 hr6pOQ/+O2ELjqV53pgkdL+PVj3s0Rxe3i+dizO3j9eTtYfYsZjSWF1yasis1LpL
 sglFJtep2K18uI6nnPrti61tPFZviq3rYCBqKRi6A6AT518ZgelBn2v9qHwodiRa
 8JSygyFymnfjEXf0JVM076e2l7ZC0/LEdaYb0iKC8htp5D+yQcasRB2algKAiztE
 RNIOUk4CciNCNHPZwzc6epFGBn5a+kxYZi3KVdjmBsovw0zOIbfe7PJe/VSmXocR
 RfuDW2ZyWWH8MwlOkrTA68VBLK9lz/sXrWyF5TEBfu73oxKCeuoW/ZQGEQ4tjjT5
 yad9MtfQZPaPtDxMBBhlKOd2eGs3xpeoiWKSc/C1Xup0c6IZSpU4e5tB98w3cw96
 WEfGKcPwkl27uzGwUaG/xTUTjZtqnmv1tYdtq3on6pDSTp/K9SVX9VtEkywvVDya
 dAznCqY22CtsBWyb7CJ7Qhj+plu5tJ6ajFCqxNTbH7/mxil8dUobMPyzt3Nu3e8L
 cNDDnqC3l20N7SSi06m1abyGbvfhnS+2tDJ1xpK6maMCU8tLfebWapns0RfJtTa6
 ZytUOED2lkBXhx7jwP0Qyx12RV9Wr3XHmtBLqM1Es97qeRS7HsHUWci9KzxT2Tb2
 YUr/y3wGG3C28FPWh1MVnnsSUzl7hTbHtZZE+FXHe80JpkxvYK8=
 =NmlO
 -----END PGP SIGNATURE-----

Merge tag 'drm-next-2026-04-22' of https://gitlab.freedesktop.org/drm/kernel

Pull more drm updates from Dave Airlie:
 "This is a followup which is mostly next material with some fixes.

  Alex pointed out I missed one of his AMD MRs from last week, so I
  added that, then Jani sent the pipe reordering stuff, otherwise it's
  just some minor i915 fixes and a dma-buf fix.

  drm:
   - Add support for AMD VSDB parsing to drm_edid

  dma-buf:
   - fix documentation formatting

  i915:
   - add support for reordered pipes to support joined pipes better
   - Fix VESA backlight possible check condition
   - Verify the correct plane DDB entry

  amdgpu:
   - Audio regression fix
   - Use drm edid parser for AMD VSDB
   - Misc cleanups
   - VCE cs parse fixes
   - VCN cs parse fixes
   - RAS fixes
   - Clean up and unify vram reservation handling
   - GPU Partition updates
   - system_wq cleanups
   - Add CONFIG_GCOV_PROFILE_AMDGPU kconfig option
   - SMU vram copy updates
   - SMU 13/14/15 fixes
   - UserQ fixes
   - Replace pasid idr with an xarray
   - Dither handling fix
   - Enable amdgpu by default for CIK APUs
   - Add IBs to devcoredump

  amdkfd:
   - system_wq cleanups

  radeon:
   - system_wq cleanups"

* tag 'drm-next-2026-04-22' of https://gitlab.freedesktop.org/drm/kernel: (62 commits)
  drm/i915/display: change pipe allocation order for discrete platforms
  drm/i915/wm: Verify the correct plane DDB entry
  drm/i915/backlight: Fix VESA backlight possible check condition
  drm/i915: Walk crtcs in pipe order
  drm/i915/joiner: Make joiner "nomodeset" state copy independent of pipe order
  dma-buf: fix htmldocs error for dma_buf_attach_revocable
  drm/amdgpu: dump job ibs in the devcoredump
  drm/amdgpu: store ib info for devcoredump
  drm/amdgpu: extract amdgpu_vm_lock_by_pasid from amdgpu_vm_handle_fault
  drm/amdgpu: Use amdgpu by default for CIK APUs too
  drm/amd/display: Remove unused NUM_ELEMENTS macros
  drm/amd/display: Replace inline NUM_ELEMENTS macro with ARRAY_SIZE
  drm/amdgpu: save ring content before resetting the device
  drm/amdgpu: make userq fence_drv drop explicit in queue destroy
  drm/amdgpu: rework userq fence driver alloc/destroy
  drm/amdgpu/userq: use dma_fence_wait_timeout without test for signalled
  drm/amdgpu/userq: call dma_resv_wait_timeout without test for signalled
  drm/amdgpu/userq: add the return code too in error condition
  drm/amdgpu/userq: fence wait for max time in amdgpu_userq_wait_for_signal
  drm/amd/display: Change dither policy for 10 bpc output back to dithering
  ...
2026-04-21 17:39:21 -07:00
Linus Torvalds
87768582a4 dma-mapping updates for Linux 7.0:
- added support for batched cache sync, what improves performance of
   dma_map/unmap_sg() operations on ARM64 architecture (Barry Song)
 
 - introduced DMA_ATTR_CC_SHARED attribute for explicitly shared memory
   used in confidential computing (Jiri Pirko)
 
 - refactored spaghetti-like code in drivers/of/of_reserved_mem.c and its
   clients (Marek Szyprowski, shared branch with device-tree updates to
   avoid merge conflicts)
 
 - prepared Contiguous Memory Allocator related code for making dma-buf
   drivers modularized (Maxime Ripard)
 
 - added support for benchmarking dma_map_sg() calls to tools/dma utility
   (Qinxin Xia)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaeCbdQAKCRCJp1EFxbsS
 RHbWAQCt70dzrU0lu0omTR1HdDP4GTYfuM6nZR91e8/itGN1+QD/XH4I/0wuybzk
 v5uxbIC6lR3abQRc3YNRXfi+i5j26A4=
 =Oee2
 -----END PGP SIGNATURE-----

Merge tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping updates from Marek Szyprowski:

 - added support for batched cache sync, what improves performance of
   dma_map/unmap_sg() operations on ARM64 architecture (Barry Song)

 - introduced DMA_ATTR_CC_SHARED attribute for explicitly shared memory
   used in confidential computing (Jiri Pirko)

 - refactored spaghetti-like code in drivers/of/of_reserved_mem.c and
   its clients (Marek Szyprowski, shared branch with device-tree updates
   to avoid merge conflicts)

 - prepared Contiguous Memory Allocator related code for making dma-buf
   drivers modularized (Maxime Ripard)

 - added support for benchmarking dma_map_sg() calls to tools/dma
   utility (Qinxin Xia)

* tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: (24 commits)
  dma-buf: heaps: system: document system_cc_shared heap
  dma-buf: heaps: system: add system_cc_shared heap for explicitly shared memory
  dma-mapping: introduce DMA_ATTR_CC_SHARED for shared memory
  mm: cma: Export cma_alloc(), cma_release() and cma_get_name()
  dma: contiguous: Export dev_get_cma_area()
  dma: contiguous: Make dma_contiguous_default_area static
  dma: contiguous: Make dev_get_cma_area() a proper function
  dma: contiguous: Turn heap registration logic around
  of: reserved_mem: rework fdt_init_reserved_mem_node()
  of: reserved_mem: clarify fdt_scan_reserved_mem*() functions
  of: reserved_mem: rearrange code a bit
  of: reserved_mem: replace CMA quirks by generic methods
  of: reserved_mem: switch to ops based OF_DECLARE()
  of: reserved_mem: use -ENODEV instead of -ENOENT
  of: reserved_mem: remove fdt node from the structure
  dma-mapping: fix false kernel-doc comment marker
  dma-mapping: Support batch mode for dma_direct_{map,unmap}_sg
  dma-mapping: Separate DMA sync issuing and completion waiting
  arm64: Provide dcache_inval_poc_nosync helper
  arm64: Provide dcache_clean_poc_nosync helper
  ...
2026-04-17 11:12:42 -07:00
Jason Gunthorpe
126c50bc2f dma-buf: Remove the old selftest
Nothing uses this framework anymore, remove it.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/5-v1-0a349a394eff+14110-dmabuf_kunit_jgg@nvidia.com
2026-04-16 12:34:00 +02:00
Jason Gunthorpe
6055c9e333 dma-buf: Change st-dma-fence-chain.c to use kunit
Modernize the open coded test framework by using kunit.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/4-v1-0a349a394eff+14110-dmabuf_kunit_jgg@nvidia.com
2026-04-16 12:34:00 +02:00
Jason Gunthorpe
465f393438 dma-buf: Change st-dma-fence-unwrap.c to use kunit
Modernize the open coded test framework by using kunit.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/3-v1-0a349a394eff+14110-dmabuf_kunit_jgg@nvidia.com
2026-04-16 12:34:00 +02:00
Jason Gunthorpe
9baa35a399 dma-buf: Change st-dma-fence.c to use kunit
Modernize the open coded test framework by using kunit.

Add a num_online_cpus() check to test_race_signal_callback() as the
default kunit.py runs the VM with a single CPU and this test depends on
two truly parallel kthreads. Skip it instead of hanging.

Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Link: https://lore.kernel.org/r/2-v1-0a349a394eff+14110-dmabuf_kunit_jgg@nvidia.com
2026-04-16 12:34:00 +02:00